# PaCkAgE DaTaStReAm
SMCnmap 1 6996
# end of header
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            07070100243fd9000081a40000000a0000000a0000000144fe8f28000000a3000000880000000a00000000000000000000001000000005SMCnmap/pkginfo   PKG=SMCnmap
NAME=nmap
ARCH=sparc
VERSION=4.11
CATEGORY=application
VENDOR=Fyodor
EMAIL=steve@smc.vnet.net
PSTAMP=Steve Christensen
BASEDIR=/usr/local
CLASSES=none
 07070100243fd1000081a40000000a0000000a0000000144fe8f28000007fa000000880000000a00000000000000000000000f00000005SMCnmap/pkgmap    : 1 6996
1 d none bin 0755 bin bin
1 f none bin/nmap 0755 bin bin 982312 58983 1157533477
1 d none doc 0755 bin bin
1 d none doc/nmap 0755 bin bin
1 f none doc/nmap/CHANGELOG 0644 bin bin 192007 17396 1157533478
1 f none doc/nmap/COPYING 0644 bin bin 25611 2002 1157533478
1 f none doc/nmap/COPYING.OpenSSL 0644 bin bin 6279 52967 1157533478
1 f none doc/nmap/HACKING 0644 bin bin 4113 34960 1157533478
1 f none doc/nmap/INSTALL 0644 bin bin 215 19269 1157533478
1 d none doc/nmap/docs 0755 bin bin
1 f none doc/nmap/docs/README 0644 bin bin 324 28914 1157533479
1 f none doc/nmap/docs/leet-nmap-ascii-art.txt 0644 bin bin 1100 52825 1157533478
1 f none doc/nmap/docs/nmap-man.xml 0644 bin bin 173519 6535 1157533478
1 f none doc/nmap/docs/nmap.1 0644 bin bin 127238 8630 1157533478
1 f none doc/nmap/docs/nmap.dtd 0644 bin bin 7812 64526 1157533479
1 f none doc/nmap/docs/nmap.usage.txt 0644 bin bin 4497 52523 1157533478
1 f none doc/nmap/docs/nmap.xsl 0644 bin bin 21552 37467 1157533479
1 f none doc/nmap/docs/nmap_gpgkeys.txt 0644 bin bin 5001 19287 1157533479
1 f none doc/nmap/docs/nmapfe.1 0644 bin bin 2784 49916 1157533479
1 f none doc/nmap/docs/xnmap.1 0644 bin bin 18 1452 1157533478
1 f none doc/nmap/nmap-4.11-1.spec 0644 bin bin 4592 6521 1157533479
1 d none man 0755 bin bin
1 d none man/man1 0755 bin bin
1 f none man/man1/nmap.1 0644 bin bin 127238 8630 1157533478
1 i pkginfo 163 13511 1157533480
1 d none share 0755 bin bin
1 d none share/nmap 0755 bin bin
1 f none share/nmap/nmap-mac-prefixes 0644 bin bin 225546 51293 1157533477
1 f none share/nmap/nmap-os-fingerprints 0644 bin bin 809345 60962 1157533478
1 f none share/nmap/nmap-protocols 0644 bin bin 6318 50757 1157533478
1 f none share/nmap/nmap-rpc 0644 bin bin 17955 57350 1157533478
1 f none share/nmap/nmap-service-probes 0644 bin bin 557444 38434 1157533478
1 f none share/nmap/nmap-services 0644 bin bin 108536 50692 1157533478
1 f none share/nmap/nmap.dtd 0644 bin bin 7812 64526 1157533478
1 f none share/nmap/nmap.xsl 0644 bin bin 21552 37467 1157533478
  07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000b00000000TRAILER!!!                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        07070100243fd9000081a40000000a0000000a0000000144fe8f28000000a3000000880000000a00000000000000000000000800000005pkginfo   PKG=SMCnmap
NAME=nmap
ARCH=sparc
VERSION=4.11
CATEGORY=application
VENDOR=Fyodor
EMAIL=steve@smc.vnet.net
PSTAMP=Steve Christensen
BASEDIR=/usr/local
CLASSES=none
 07070100243fd1000081a40000000a0000000a0000000144fe8f28000007fa000000880000000a00000000000000000000000700000005pkgmap    : 1 6996
1 d none bin 0755 bin bin
1 f none bin/nmap 0755 bin bin 982312 58983 1157533477
1 d none doc 0755 bin bin
1 d none doc/nmap 0755 bin bin
1 f none doc/nmap/CHANGELOG 0644 bin bin 192007 17396 1157533478
1 f none doc/nmap/COPYING 0644 bin bin 25611 2002 1157533478
1 f none doc/nmap/COPYING.OpenSSL 0644 bin bin 6279 52967 1157533478
1 f none doc/nmap/HACKING 0644 bin bin 4113 34960 1157533478
1 f none doc/nmap/INSTALL 0644 bin bin 215 19269 1157533478
1 d none doc/nmap/docs 0755 bin bin
1 f none doc/nmap/docs/README 0644 bin bin 324 28914 1157533479
1 f none doc/nmap/docs/leet-nmap-ascii-art.txt 0644 bin bin 1100 52825 1157533478
1 f none doc/nmap/docs/nmap-man.xml 0644 bin bin 173519 6535 1157533478
1 f none doc/nmap/docs/nmap.1 0644 bin bin 127238 8630 1157533478
1 f none doc/nmap/docs/nmap.dtd 0644 bin bin 7812 64526 1157533479
1 f none doc/nmap/docs/nmap.usage.txt 0644 bin bin 4497 52523 1157533478
1 f none doc/nmap/docs/nmap.xsl 0644 bin bin 21552 37467 1157533479
1 f none doc/nmap/docs/nmap_gpgkeys.txt 0644 bin bin 5001 19287 1157533479
1 f none doc/nmap/docs/nmapfe.1 0644 bin bin 2784 49916 1157533479
1 f none doc/nmap/docs/xnmap.1 0644 bin bin 18 1452 1157533478
1 f none doc/nmap/nmap-4.11-1.spec 0644 bin bin 4592 6521 1157533479
1 d none man 0755 bin bin
1 d none man/man1 0755 bin bin
1 f none man/man1/nmap.1 0644 bin bin 127238 8630 1157533478
1 i pkginfo 163 13511 1157533480
1 d none share 0755 bin bin
1 d none share/nmap 0755 bin bin
1 f none share/nmap/nmap-mac-prefixes 0644 bin bin 225546 51293 1157533477
1 f none share/nmap/nmap-os-fingerprints 0644 bin bin 809345 60962 1157533478
1 f none share/nmap/nmap-protocols 0644 bin bin 6318 50757 1157533478
1 f none share/nmap/nmap-rpc 0644 bin bin 17955 57350 1157533478
1 f none share/nmap/nmap-service-probes 0644 bin bin 557444 38434 1157533478
1 f none share/nmap/nmap-services 0644 bin bin 108536 50692 1157533478
1 f none share/nmap/nmap.dtd 0644 bin bin 7812 64526 1157533478
1 f none share/nmap/nmap.xsl 0644 bin bin 21552 37467 1157533478
  07070100243fda000041ed0000000a0000000a0000000644fe8f2800000000000000880000000a00000000000000000000000600000005reloc 07070100243fdb000041ed0000000a0000000a0000000244fe8f2800000000000000880000000a00000000000000000000000a00000005reloc/bin 07070100243fdd000081a40000000a0000000a0000000144fe8f25000efd28000000880000000a00000000000000000000000f00000005reloc/bin/nmap    ELF                  4 P     4    (      4  4                                                                              D p                            /usr/lib/ld.so.1                                                  	   
                                                                                         $                   %   &           '       )       *               ,       .   /       1   2   5   8   ;   <   =       @   A   B   E       G   I       J   K   L       M   N           O   P   Q   R   S   T       U   X   Y   Z               [   ]   `   d           e   g   h       i   j   k   l   m   o       p       q   r   s   u           v       w   x           z   ~                                                                                                                                                                                                                                                                                                                                                                                              	  
                                                               !  #  $  &      (  )      *      +          ,      -  /  2  4  6  8  9              :  >  @  B      C  E  G      H  J  K              L  M  N      O  Q  T  U      W      X  Y  Z      [  ]      ^      d      e  f  g  h  j  l  m              o  p  q                  r  s  u      v          w  y      z  }                                                                                                                                                                                                                                                                                                                                                        	  
                                           !  #      $  (      )      -  .  0          1  2  4      5  6  7  8              9      :      ;  >  ?  A          B  C  D      G          H  K  L      M          N  O      P          Q  S  U  X  Y  Z      \  ]  `  b          e  g      i  j  k      l      m      o  p  r      s      u  v      w  x  y  z  }                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                               !  "  #  $      %  &  (  +      ,  -  .  /  2  5  7          9                  :  <  =  >      ?  @  A  E  F      G  I  J      K  N      Q  R  U  V  W  [  \  ]      `  a  b  d      e      f      i  k          m      n  o          q  s              t      v      w          y  {          |                                                                                                                                                                                                                                                                                                                                                                                                   	                                                                  !          &  )  -      .  /  1      2          3  5  8      9  <  =  @      A  B  C      E  G  H      I  J      K  M      P          Q          R          S  T  U      V              X  Y          Z      ^      _  `  a  c  d      e  g  h  j  k      n                      o  q          r  s  t  u  w  y  }  ~                                                                                                                                                                                                                                                                                                                                                                                              	                                                   !  "      %  &  (      )  *  ,  .      /  0      1  2      4  5              7              8  :              <  >  ?  @  A      B          C  F  G          I      J  K  M  N  O          P          Q  S  T  W  Y      \  ]  _  `  a  b  c  d  e  h  j  k      l  m  n          r  u              x  {      }                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            !  #  &  (      *  +      ,      -      .  /  2  3  4      6  9      :  <  >  @  A          C  D  E      F              G  I  K                  L  M  N      O  P          Q  S          U              V  Y  \  _  a      b  c  d      e  f  g  h          i  l  n  o              p  r          s      t  v      y  {  }      ~                                                                                                                                                   !   "   #                   (           +       -           0           3   4       6   7       9   :               >   ?               C   D       F       H                                                       V   W                   \       ^   _       a   b   c           f                               n                       t                   y       {   |   }                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "          %      '                          .      0  1      3      5      7              ;  <  =      ?      A          D      F          I                          P      R  S          V                      \          _  `  a  b  c                      i      k          n                      t              x          {  |      ~                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 "          %  &  '          *  +  ,          /              3                                  <  =          @                  E  F          I  J                              R      T      V  W              [          ^  _      a      c  d      f      h                      n          q          t                          {  |      ~                                                                                                                                                                                                                                                                                                                                                                                                                                                                           	                                                                                                      '      )  *                      0  1      3  4      6      8          ;                          B  C  D              H              L  M      O  P          S  T              X  Y  Z              ^  _              c              g  h      j      l              p      r          u          x      z          }  ~                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
                                                                               "  #  $  %      '  (      *  +  ,              0              4      6  7          :  ;          >  ?                  D      F                      L      N  O                              W              [  \  ]                  b              f          i          l  m          p                      v      x      z  {  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
                                                                              #  $          '              +      -                      3          6          9      ;      =                          D  E          H              L                      R          U  V      X      Z  [          ^                              f  g      i                      o  p  q      s  t      v  w      y  z      |      ~                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  	  
                                                                                  "      $  %      '      )                          0  1              5      7  8          ;      =      ?          B                      H      J                              R      T          W  X      Z  [      ]  ^      `                                      j  k      m              q              u      w  x      z      |                                                        @               "    8     4" ~   t s   0  	    Y   d" 4     <  	  7 4   T"    j   h" Q   	f   $  	   	G   T  	                       !    	  H 7    	  h 
pP     	   
   `"  &   ֘   ("    
   d"  $      8" T         ( l      1 (   d"    X   `" (   D   H" V  K (   "    0   "  q   
p   "     <   H"    	   (  	   l         	 
B     	      "   P    "    yX     	      t  	   mt   ," [   X          Q|   "    
,   T  	       	  P 
   ,"    `    h"    {   <"    |h   P"    =|   l"     \          
   L"  ;  `     	   K   0"    
r@     	   
uh     	   
   0"  @   
δ  x  	    H    	   j     	   	   L  	  0 J\    "    F o   L" f  \          | 	   @  	   
   l"  4   l          `    	   <   " 6  	" 
   "  ?  	}    4"   	    <  	  	      	  	 t         	          	 (   ("   
! !   ("    
B 
   L"  B  
   	!   
 r   (" o  
 k    	  
 7   ,"    
        "         "   M    "        	   ]p  " G  . :h   "    C C   8"    c <   `" !   b     	   
ߌ   ,"      
$    "  "          "      X   "    9    "    H     ("   r    <"        "  k             	L   h  	   l   ,"    	$     	      $"   I 3   ("    u F`    "     d          X   l"  _   d   (" \  %    h  	  9 X   |"   i          q      s X   ," B   	n    	   H    "     id     	              h    	   9   ("    0 C   l"    L      "   n T   L"  h       h" e   f  p  	   (          {  D  	     $  	  (      	  N 
O     	  ]      	  t 3    	   `   t  	   
0   "  ,             ,"   ) ,   l"   O 4h    "                 $  	   
   <"  D   |     	      "    H    	  R 4    	  k          r    "    	     	       "        "                       	 1    "    $ 
8   0"  2  C      	  k          s 
͈  ,  	  { 9(  4  	   4     	   D     	      L"   - +     	  L Ƽ   ,"   w    " n   Ԁ   "       8"  {   {    @"   e 1  8  	      ("    L4   8"       l" x  =    x  	  [ _   x  	  q 
uH     	  ~ 
   "  (   tt   l" v   t   t"   B 
   "  >  J 
>   p  	  ^ 
?L   $  	  q 
|     	  | ǀ    "    {<     	      $"    [   H" >  A     ,"   r    H"  }   8                 6  ,  	   0@  d  	       "   1 -   l"    x \4   " A      $"    2     	   0          
T   "     
D     	            " $t   $"    f 	p  T  	  s h         } L   L"    	$   \  	   H     	   *D   \"    t 9    	             t   ,"           "      0   d"  `  I t   P"   }           3    "                  `" Q  .          <    0" )  | $   ," 1             `   ("    
2   D  	      p"   p 
@     	      L"        	   	A   0  	   ߄    "     t   p" w    }t   "     `   d"   !_ ,   |"   ! 0   "    !          !     "   ! 	y    	  !      	  ! Ӭ   "   "     " Y  "v $    "   " 
   l"  *  " 0   ("   # 	    	  #! 	a     	  #3 Yx   " 0  #W      	  #p     "  l  # Y@   (" .  # %   h"    $ 8   ("   $P 	8      	  $\ h@   0  	  $m          $u 4   4"   $ 0     	  $ 	    	  $ K   8" 
  % 
   "    %. `   P"  b  %[ M(   D"   % 4         % ml  0  	  %    L  	  %    X  	  %           & p    
  &    "   &T U     	  &e 
  t  	  &q    H"   & Y   " 3  '4 Yh   " /  'w 	5  P  	  '    0"   '          '     "   ' 4    "   ' 
s     	  ' `   H" %  (E 
   <"  ^  (}      	  (     	  ( sT   0  	  (    ,"   )  
   $  	  )) 	   0  	  )= (   \  	  )Q Gd   d"    ) 	H     	  )     "   ) @   "    *? !0   0"    *^ T    	  *u 
$    	  *}          * 
   "    * X   d" +  +.    H"   +L h   p"  U  + o  
  	  + Ƥ   "   ,      	  ,#    <"   ,j          ,s    " <  , :\    	  ,    p  	  ,     	  - ,4   p"    -l 
x  4  	  -v 
4   T  	  -~ l   "   -          - k   ," S  .% l   P"   .K 
    	  .U 	L  p  	  .` @         .j 
     	  .u n     	  . 8   d"   . $   P"   .     	  .      	  / 	X    	  /    4"   /L       /R 	   4"  \  / <   @  	  / x   T  	  /       / m   (" ]  /    H  	  / L         / *    	  0' P    "  w  0Y    p"   0        "     0 zP   T"   0 (     	  0 5     "    1     	  1) 	4   $  	  13        "     1G D   <"   1r 	    (  	  1 l   4" U  1 c  <" H  2 8         2    "   2H 	GP   (  	  2]     	  2o 	T   l  	  2 Ĥ  "   2     	  2          2 
  $  	  2 p   d"   3    " @  3 	`     	  3    4"   3    (" ]  4! cx   |  	  4@ 
   8  	  4I *   h"    4    ,  	  4 
     	  4 	   8  	  4 B   H"    5	 P   H"   5`    "  t  5 l         5 	   X  	  5 %    	  5 Z   " 9  6          6 X    	  62 OX   P"   6          6          6 0   ("    6 Ԑ   "   7 
P      	  7) Ѩ   D"   7r          7y 6    ("    7          7   D  	  7          7      	  7          8          8
 
Ad   X  	  8 H   p"    8L jX   0" N  8 D   0"   8 D<   L"    8 w    	  9      	  9% x   X"   9A D   $"   9 
t     	  9     	  9 (   4" `  9      	  : 20   l  	  :2 {   \"   : zx  D  	  :    H  	  : \   $" D  ;1 T         ;9 	,     	  ;D T    	  ;p          ;w      	  ; 9   @"    ; =   8"    ;      	  < 6    "    < F   p"    <Q    \" f  < T         <    (" 9  =< 
ʬ   T  	  =E    `" X  = t      = 	  0  	  =       = K    "   = d         =    |  	  >     	  >* G   "    >Z       >e          >t 0         >|    d"  o  >    ("   >    "   ?- 
ɤ    	  ?6 \    	  ?Y 	G    P  	  ?`    0"   ? 	     	  ? &     	  ? ,         ?    4"   ? 	(      	  ? l   ," V  @*    \" b  @       	  @ x    "   @ 
   "  <  A 
X   ("  :  AC 	n   <  	  AL 
   @"  6  A (         A     "   A p         A m   " \  B X   p"  r  B)          B1    ("   BY 
   T"    Br       B|    D  	  B    "   C    (" :  CK \   " F  C 0   x  	  C 
`     	  C    "   C 5    "    C J   "   D" 
mP     	  D9 [   <" ?  Dk 	G   0  	  D          D IP   "    D          D          D 	[     	  D    ,"   D          E #,   "    E.    x  	  EJ     "   Eu    `"   E 8   4"   E 8    "    E 4   ," $  F0          F6 }   0  	  F[    ("   F r`   0" n  F +  4  	  F 
    	  F     "    G5 P    	  G\ D     	  Gq          Gy          G~ x   t"   G E$   d"    H" H   ("   HO P   h"  Z  H    8" M  H 
   "  F  I          I "d   <"    ID 
   d  	  IS `         IZ 
   \  	  Id l    	  I 
    	  I N@   $"   I       I      	  J    H"   J= V<  X  	  Jc    h" *  J 	    	  J       J 8   $"  M  K9 |     	  KG h   0  	  KX    H" H  K >    	  K T         K uP   " x  Lf X   H  	  L~   L  	  L %   0"    L    4"  S  L      	  M 
  H  	  M)    "   MT ͜   `"   M{ #   "    M    T  	  M w   4"   NU a     	  Ns    ("   N \     	  N 
    	  N    4" I  N _    	  O    H"  R  OZ    H"  f  Oy tl      	  O    |  	  O          O       O |         O 
   0"  I  P    H  	  P D     	  P5 -   d"    P 	\    	  P 
s     	  P 	0    	  P    @"   Q       Q    "   Qh    P"   Q 4   P  	  Q 
L   p"  '  Q H         Q dt   T  	  Q CD   <"    R LT  L  	  Rg 
P     	  Rw 	nP   \  	  R ,   (" Z  R    "   R     	  S kt     	  S 8   ,"   S1 >x   `"    S p   t  	  S 1   `"    S    0"   S 	gh   x  	  T X    " 
  T+ 
r     	  T= l    	  TW 4   "   T 
    p"  ]  U }   h"   UR @     	  U{    d  	  U X   |"  v  U     "   U D   H"    V/ 
8     	  V< 7   d"    VU xD    	  Vc          Vk 
?    L  	  V{    ,"   V 	(    	  V 	|    	  V 	   0  	  V 
    	  V 0   "   W' X   p" u  W    0"   W 	ux    	  W u4    	  W x         X  
ܨ   "    X! ,   4"   XM M    "   X 2     	  X          X 4    "     X I    	  X    "   Y 
   "  C  Y2 4   `"    Y^ d   D"   Y     "   Y    d"   Z\ P   D"   Z d   (  	  Z 9D   @"    [	 (    "   [$          [)   D  	  [@ 	dD   t  	  [O h   "   [ 8   4" |  [ 	Z   $  	  [    t  	  [    ("   \F        \` 
`  4  	  \j 	      	  \~ <         \ \   ," a  \ 	
<    	  \ ˘   X"   \ 	w    	  ] \   ("   ]:    L"   ]y E   "    ] d   d  	  ] 
t     	  ]    $" k  ^ I   "    ^E          ^L 	    	  ^Z    "  W  ^ x   4"   _ $   h  	  _    "   _6          _A    8" U  _o WD    	  _ Ll   L"   _ 
u8     	  _ O  d  	  `)   @!   `.    @  	  `D    ("   `n {@   H"   ` 
    	  ` 	     	  ` X     	  ` d   p"   a"    d  	  aH X   " R  a 
@   $  	  a q    	  a 	   T  	  a     	  b [t   " =  b? 7x   "    bh <      b}      	  b t   L  	  b 	ZX   $  	  b ?   `"    b 	;    	  c 
    	  c     	  c5 0   "  ~  c    ," =  c    p" q  d7 d    	  d_ @    "     du    ,"   d <   L"    d XX    " )  e' 0   8"  z  eG     "   eg    ,"  Q  e zD   "   f	          f    0  	  f 	C|    	  f*       f5 $     	  fR 
$     	  fZ 
   "    fy 
    $"    f    ,  	  f  x    	  f    t  	  f          f p4   D" g  gh t   "   g ~   4"   g |    H"   g       g U   \  	  h hp   L  	  h& p         h.    ("   hV =0   L"    h    (  	  h 
   X  	  h ި    "   h G   ,"    h `     	  i	 y   `"   iy D         i 	  D  	  i c     	  i    0"   i X,   " '  j |         j$     	  j=      	  jS 	[   $  	  jZ 0         jf      	  j        "     j              j    H"   j 8   <"    j      	  k!          k& 	     	  k5          kJ    H" &  k 
s     	  k    "   l j   (" P  lM    p" L  l ,     	  m h   "   mU 
t     	  mf [   <" ;  m $         m    H  	  m 
@    	  m p   "   n%   p  	  n6    ,"   n^ p   h" i  n 8   h  	  n 	X   <  	  n    H" _  n |         o Z   (" 7  o4    ("   o] 
    $"  H  o 	     	  o Cx     	  o r   T" m  p  (     	  p- n(   ," `  pg l   ("   p   0  	  p t         p        "     p yp   ,"   q 
(   |  	  q P  <  	  q[      	  q{     "   q \         q $   d  	  q    " ;  r  \   " C  rK #    	  rk D,  X  	  rx     "   r    4" P  r (    	  s          s
 	   X  	  s    "   s4 6H   d"    sX l    	  s~ 4     	  s d   T  	  s ,  ,  	  s 
n   h  	  s    h" '  tX 	   H  	  ty          t 
t     	  t   	  	  t 	_    	  t 
    "    t    "   u   x  	  u4 b4     	  uN x8     	  uh $   |  	  u    ("   u    " h  u 	a    	  v D   8" F  v$ \         v3 7   4"    va    4" r  v 	     	  v L   $"   v           w H         w M   X"   wW    <  	  wz D         w    "   w y   H"   x #T   @"    xH v0   h  	  x_ O   8"   x{       x D   $"   x D   L"   y 	gD   $  	  y"    @"   yI D   8" N  y| ߤ   ("   y          y     	  y 
u     	  y 5     	  z    h" #  zh     4"  T  z -  @  	  z d   @"   {.     	  {i     	  { ʄ   4"   { Ip   ("    { ٔ   @"   |/     "  c  |K 6     "    |a P   t  	  | 
8   "    | 	p   p  	  | SL  T" $  }
        } J|   0"   }7 	     	  }F        }O 
D   $"    }m +  $  	  } 
x   8"  7  } 	:    	  }    <  	  }     "  L  ~' <   "   ~z <         ~ \    	  ~ <   4"    ~    d" {  \ =x    	   
    	         	             
l     	   h   \"    
    "  !  ' 'x  h  	  8 	Ht   (  	  E 	L     	  Q R   " !   $   "    
	8    	     h  	  % 
    "  1  9 
u   ,  	  E d  b  	  V D   ("    ~ k   " T   	     	   |   T"              	T     	  1 
P    	  < {     	  R )   4"     @   <"    L    "    @0     	   'D   H"    X |   H" ,   m@   4" Z                       H         
    @"   9 H    "    b          r 
Bt   \  	      0  	           
P   "        <" 4      " 	  .    H"   n X   H"    $   H"    X  \  	       "              ! y$   L"    \     	   	m   H  	   M|  ,  	  $ h   l" z  w    ,"       h"  N      "   6    $"  d  [ ż    "   ~           \   ,"       "              ,   `" .  9 P   ," +              t   \  	   	A    	       "    ֈ   "    0T   "    
 D   ,"    4 m   (" ^   (    	   <   (  	   t    	   4     	   
s     	   	    d  	   5h   X"    #    d" y   ۜ    "              
p   ("  .      " K  S       Z L         `   d  	  n u     	          "        8  	   q      	   ɼ   L"   -    \"  Y   	K,    	   
  P  	   \   " 	  
 (   "   A    $  	  Y 
   "  5   	  L  	   3    "     Y   ," 1      d"   | 8     	   !   L"     	[0   X  	   v   ,"    	    	   	r    	   =   ,"     
   \  	   ,                 	l   D  	   
A     	  
 T    "   1 K,  	  	  D 	   |  	  S ~   "        "       (" C   xx   L"   U 8   `"  i  l *H  h  	        	   \   " E      0  	  ! Ո     	  < J   x"   \ 	N  H  	  h |   H  	  t $  0  	      ("    
   d  	      "   S 	,     	  c Z,  T  	  ~           v|   " |   z   \"   T          ^      
  e L   P"    l   4" }   x                    %X   t  	   F    "    < &   ,"    | ̠   "    ?h   L"     
    "        4"  a  ; N0   "   Y l   " W       "  j   
|  ("  %       "    oL   H" d  L    p" s   "    	       " ?  2 O  H  	  v 1   `"     
@   D"         "    Ml   P"    
L   H"  =  7 h   "    
$    	   l    	      "       ,"   ? 	    	  N \  T  	  l s    	  |      	   K    " 	   	D     	   |  <  	   
q     	   4   d" w  y e    	     $  	       "    h   p  	   v   T  	         	  7    "   _   ,  	   h   "  P             	\   $  	   
P   "  -   	i  d  	  $          + `   <"   R p         d sp   H" r   $          
W    	   ,     	   6D    	            % ޘ   "   V    ,"       T  	             P   "    A   h"       p  	  +          1 HT  8  	  Y 	5D   D  	  l          t T   H  	   T    	   l     	   >    0"     ,  T  	  : +   4"    h   $  	   8T   d"     P   " 7             
X   <  	   N     	  ! h      ) Zt   (" 6  y 
x     	   Ӽ   ,"    	Z   <  	       	   x   ,"   -          3 x   p"         	      D"    ¼     	  .    d"    qd    	   
݈   "     3H   `"     |   H" O       	      t  	   Š    	       "  g      "  s   v    H" z  .          7 	t    	  @ J   ("   d px   <" h   l    	   	"t    	   p       D   P"   # 4   ,"   L $D   "     Y    " 2   X   $" ,               	  ,   p  	   
ݤ    "     	x  (  	   
     	   4   X"     h   "   ) 
d   ("  #  O p   `"  p  p vh   " {       "    t   X"        	  / 	d     	  < 
P     	  K 8     	  ] W   H" &        	   ^,    	          "      	f   $  	   N   p"   U (         [ R   @" "   T   x  	      d  	   W   D" %  #       	  <     "  m  K }   "       d"              |   (  	   i   T  	   
  $  	   	g   (  	   N   $"   ] $     	  w 	     	   \   ,"    
uX     	   8          	md     	      4" p  	 j@   " M  T ,   "    
=     	   Wt  \  	   3  \  	        	   8   ("                 \  	  &      	  8     	  g s   \  	  w )l   `"     N   "   5 
N   X  	  ?   @   E   x  	  Z P   |  	  n    H"    Q   l"     w   4"    `       5@   ("    > 	Z   $  	  L    @"   y ؈   H"                  "    ih   p" K  9 s   " s  w "   ("     	       	   Xx   " *      ," ^  F    0" "  q 6    	             2\   "                   	   r     	   ی   "   >    ("   e          m          y J   "       $  	   EP    	       	   	   X  	          	RD    	      P"   8          ? $   " >  v     	   	X     	        	   	     	   *,   "    : G   "    j   	   r ?   `"        0"    h          x   H"         	  ( ,   x  	  D     <"   v d   p" S   5     "     
o   x  	  1   |  	  p Nd   `"    $   h"    D          Q       [ r   h" p   i,   $" I   ݘ   ("   * 	Z   $  	  2       I oX  T  	  h XH   " (  } l    	   i   h" L          $ 
M     	  6 wH   "    n   L" b     $  	  E 	2h    	  P 
t(     	  _    "    (     	        	  ? 
$  <  	  I 0   |  	  j t     	      4"    
   "  G   ZP   $" 5  1 $       6   d  	  F 1x   $"    ]     	  m 1\   "     	   4  	   	    	       	         	      " l  9   <  	  c X         j 
֌   H  	  t -   0  	             ̸   ,"    
    	   |   l  	   
G     	   \   X"   )     	  X   `  	  n 
   "  3   נ   H"    8              <"  J                  "   : 6   ("    W          ] -    	   c   0  	        	   
V    	   %    	         	  > 
v    	  I G     	  \    h" 0             	     	      <"   % 9   <"    Q 
D   h  	  [      	  r 	d  $  	  Â   \"       ("              D         $          * (  	0  	  6 P         D >P   ("    l 6    "    y s   d" t   B    	       H"   1 ($   p"    Ŵ 	I`   P  	  ž ۼ   X"    G   "     
T  $  	  &    $" g  |       	  Ƒ t         Ƙ       Ƣ    0" /       h" m  = $   h  	  S m  p  	  t Ǡ   ,"   Ǜ $   4" t   &   "     	   $  	  '    (" 5  F /    "    k    $" c  Ȫ }    	   ɜ    "       T  	  
              H"   H Z   " 8  Ɉ X  4  	  ɨ v   " ~  6 	H$   P  	  @   4  	  } 
   <  	  ʋ   D  	  ʨ 	     	  ʼ    \  	      @" 3  (    X"   k 
   <  	  y Ϭ   p"   ˪ Y     	      "     	0    	   [  h  	  U #   $"    ̚ 	   T  	  ̩ nT   H" a   0   `" J  H I`   "    u      	  ͐     	  ͢ 2      	  ͽ           \   p  	           `     	        	  4 
s     	  B B@     	  _    p"   Β L    	  Σ X     	                "                8  	   .   4"    I 
   d"  )  p D   `"   ϛ n   d" c   ?     	  ' J<    "    ` v   @" }  Э     "       (" D  7 t4   @" u  n t    	  є 8     	  Ѫ |     	   l8  4  	   
L     	             4          :`    	   T   @  	   ʸ   "   = 
A   X  	  O     "  x  ^          k P         p Y   (" -   h   T  	   Z   ," :   	  4  	  ( 
   x  	  2 7   ("    Y Kl    "   Ӈ    " d         	   `          
T  $  	                         	  2 
\    	  F D     	  Z     	  Ԑ    "    D    	       "        	   
?p     	  )    ("  u  Q          Z 0   "       "    >   0"     :   4"    > u   ," y  u D     	  ֓ 4   "    ֿ     h" i  $ '   ("    X 
d   ,"    g 4   ("   א ۜ    	  ׭          ״ x    "    Q   p"   V 	e|     	  e P   H" 2   `          	$     	   T    	   
G    	    
P       & 
   |"  /  O S    	  q P\   h"      4  	   	    <"  [  I ,   <  	  \ v     	  ڄ \     	  ڦ    ("       H"  |  6 	     	  D 0    	  \ G<   ("    ۇ 
P<   L  	  ۗ    "   ۾ 	l    	   Bh   "     	   X  	      "   : m   (" Y  ܋     "   ܦ @   "  e  ܺ ,         ܿ    h" -  )     ("  K  b          i <         p ?\    	  ݾ 	<     	   _@   H  	   iP   " J  " qd   l" k  n 	I  |  	  ~     "   ޙ D$   "     	    ,  	      4" W  " E   "    U T   "   ߖ    d" A   s    P" q  v    h  	   
t4     	      @"    E   "     \   (" @  # <     	  C :<   ,"    o \   ("              8    	   |    "        	   Д   D"   A    h  	  P T   " [   B     	       	   n    (" _   
C   h  	            0          7   (  	  D ^    	  Z     	  s 
4    "     ό    "    |   8" G            	    "   V h         \       {    @" o   c   0  	                       	Gx   (  	   `   |"   ; o  d  	  O (  4  	  h     \"        "        "    {    	   Y  P  	         %          - ~   <"   ^ 0p   "    v l   (" X   X   ("  n   
   ("  E   id  l  	   \H   @" B  2 
P     	  B P         L 8   ,"    y H     	      0"  y       "    8     	   	   \  	   
s     	  ' X         . o   T" e      \" j  ( ]P     	  8 d   $" 8  m          r          | 
Ҁ    	   8   @"    	Z|   $  	   
   8  	   H  <  	      h"  O  ] >D  
  	  q O   8"      L  	   q   H" j   0   @  	   4   @  	  F @   "   b 
   8"  +      ("    10   ,"     P  (  	   /   P"     04    "    B 5    "    X $         b }  P  	  v x         ~    ,  	   
   X  	   	4     	   d          H   `"  V  1 @`    	  < <<   H"    p 
8   H"  9             d   @"    
4     
    	     	  , |     	  O 	H     	  Z    ("    /   ,"     <    "       p" E  F           N j   <" O   	    	   R   `" #     p  	   
t     	   <   \"              % 
   "    C   <  	  q          | 	     	      l" v   kT   h" R  3 
    "  0  j 	 t    	  | D    "    ",   "                         	   ,  	   	]  `  	   t   H  	  0 H   d"               <"  X      ("    
nl   t  	  $     	  ;     	  s L   ("    	g    	   0    	   ^l   h  	      ("   ) 
   L"  A   	   L  	     
  	   
X   8"  8      4"    V     	   q   <" l  F p   P  	  g    ("    [L   (" <   E  X  	   0   ,"   wait _ZN9__gnu_cxx13new_allocatorIP12ServiceProbeED2Ev _ZSt11__copy_aux2IP12ServiceProbeEPT_S3_S3_S3_11__true_type _ZN7NmapOpsC1Ev _ZSt10__distanceISt20_List_const_iteratorIP13HostScanStatsEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag _Z11readip_pcapP4pcapPjlP7timevalP11link_header _ZNSt24__copy_backward_dispatchIP9probespecS1_12__false_typeE4copyES1_S1_S1_ _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_ nsp_geterrorcode nsi_setud SSL_CTX_ctrl __xnet_socket _ZN13UltraScanInfo18nextIncompleteHostEv _Z15set_pcap_filterPKcP4pcapPcz pcap_push_buffer_state _ZNKSt6vectorIP6TargetSaIS1_EE4sizeEv _ZNSaISt10_List_nodeIP9request_sEEC2ERKS3_ _ZNSt6vectorIP6TargetSaIS1_EED1Ev _ZNKSt6vectorIP12ServiceProbeSaIS1_EE3endEv pcre_free pcap_out _ZSt8distanceISt20_List_const_iteratorIP12dns_server_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_ _ZNKSt6vectorIP17ServiceProbeMatchSaIS1_EE4sizeEv _ZN9__gnu_cxxmiIPKP12ServiceProbeS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE _ZNSt4listIP11host_elem_sSaIS1_EE14_M_create_nodeERKS1_ _ZNSt6vectorIPKcSaIS1_EE9push_backERKS1_ _ZN7NmapOps13minRttTimeoutEv _ZNSt4listIP9request_sSaIS1_EE9push_backERKS1_ pcap_add_if stat pcap_ether_aton _ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchEC2Ev _ZN9__gnu_cxx13new_allocatorIP12dns_server_sED2Ev _ZN15NmapOutputTableC1Eii safe_realloc _ZNSt20_List_const_iteratorIP13HostScanStatsEppEv getuid _ZNKSt6vectorI9probespecSaIS0_EE8max_sizeEv ip6_ntoa _ZN11PacketTrace12traceConnectEhPK8sockaddriiiPK7timeval _ZSt7strrchrPci _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_ _ZSt4copyIPhS0_ET0_T_S2_S1_ _ZSt4fillPhS_RKh _ZNSt6vectorI9probespecSaIS0_EE4backEv _ZNSspLEPKc _ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEplERKi _Z19sendrawtcppingqueryiP7eth_nfoP6TargetittP7timevalP8pingtune _ZSt8_DestroyIPhEvT_S1_ pcap__scan_buffer lex_init _ZNSt6vectorIP6TargetSaIS1_EE3endEv ip6_ntop _ZN12ServiceProbeD2Ev fatal pcap_compile_nopcap _ZNSaI9probespecED2Ev _ZSt3maxIjERKT_S2_S2_ _ZNSt15_List_node_base6unhookEv pcap_setdirection _ZNKSt6vectorIP6TargetSaIS1_EE8capacityEv SSL_get1_session _Z7resolvePcP16sockaddr_storagePji _ZN9__gnu_cxx13new_allocatorIP12ServiceProbeEC2ERKS3_ _ZNSt6vectorIP6TargetSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ _ZNKSt14_List_iteratorIP11host_elem_sEneERKS2_ _ZN17ScanProgressMeterD1Ev _ZN7NmapOps20setInitialRttTimeoutEi inet_pton tolower _ZNSaIP17ServiceProbeMatchEC2ERKS1_ _ZNSt6vectorIPKcSaIS1_EE5beginEv _ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEmiERKi _ctype _ZNSt6vectorIhSaIhEE5beginEv _ZN8PortList17initializePortMapEiPti _ZNSt4listIP10UltraProbeSaIS1_EE5beginEv pthread_key_create _ZSt13__destroy_auxIPP17ServiceProbeMatchEvT_S3_11__true_type _ZNSt4listIP9request_sSaIS1_EE14_M_create_nodeERKS1_ _Z29parse_nmap_service_probe_fileP9AllProbesPc _ZNSt6vectorI9probespecSaIS0_EE15_M_range_insertIN9__gnu_cxx17__normal_iteratorIPS0_S2_EEEEvS7_T_S8_St20forward_iterator_tag _Z3boxIiET_S0_S0_S0_ _ZNSt6vectorIhSaIhEE8pop_backEv _ZNKSt6vectorItSaItEE4sizeEv _ZN8PortList14getStateCountsEii _ZSt6strstrPcPKc _ZNSaIP6TargetED1Ev pthread_setspecific _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEEC2ERKS5_ _ZNKSt14_List_iteratorIP13HostScanStatsEdeEv _ZNKSt4listIP12dns_server_sSaIS1_EE3endEv _ZNSt14_List_iteratorIP10ServiceNFOEppEi _ZN15idle_proxy_infoC1Ev _ZSt20__throw_length_errorPKc gen_neg _ZNKSt4listIP10ServiceNFOSaIS1_EE5beginEv pcap_snapshot _ZNSaISt10_List_nodeIP12dns_server_sEEC1IS1_EERKSaIT_E _ZNSt4listIP13HostScanStatsSaIS1_EEC1ERKS2_ _ZNSaISt10_List_nodeIP13HostScanStatsEED2Ev RAND_bytes _ZNSt24__copy_backward_dispatchIPP6TargetS2_11__true_typeE4copyEPKS1_S6_S2_ _ZNSaISt10_List_nodeIP10ServiceNFOEEC2ERKS3_ _ZN6Target6v4hostEv _ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EED2Ev isupper o _ZNSt14_List_iteratorIP10ServiceNFOEppEv fs_prepend _ZNSaISt10_List_nodeIP10UltraProbeEED1Ev _ZN8ArpProbe11storePacketEPhj _Znaj _Z11proto2asciihb _ZNSt4listIP13HostScanStatsSaIS1_EE3endEv _ZNSt6vectorIhSaIhEE4backEv _ZN6Target19timeOutClockRunningEv _ZN7NmapOps11packetTraceEv _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_ _ZN8PortList12getPortEntryEth __xnet_connect _ZN15NmapOutputTableD1Ev strcasestr _ZN15NmapOutputTable13printableSizeEv pcap_dump_open _ZN13UltraScanInfoC1Ev _Z7os_scanP6Target _ZN6Target17directlyConnectedEv _ZN9__gnu_cxx13new_allocatorIP6TargetEC2Ev pcap_lineno _ZNSt10_List_baseIP11host_elem_sSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E _ZN12ServiceProbe16getProbeProtocolEv _ZNSt10_List_baseIP13HostScanStatsSaIS1_EE10_List_implD1Ev select _ZN9AllProbesD1Ev _ZNSt12_Vector_baseIP6TargetSaIS1_EE12_Vector_implC1ERKS2_ _Z10gcd_n_uintiPj _ZNSt10_List_baseIP9request_sSaIS1_EEC2ERKS2_ _ZN4Port20getServiceDeductionsEP17serviceDeductions _Z19connect_dns_serversv atexit _ZN9__gnu_cxx13new_allocatorIP11host_elem_sED2Ev gen_not _ZNSt20_List_const_iteratorIP9request_sEC1EPKSt15_List_node_base _ZNSaItED1Ev __filbuf _ZdlPv _ZN10UltraProbe8protocolEv _ZSt8_DestroyIPP6TargetEvT_S3_ _ZN6Target16stopTimeOutClockEPK7timeval isdigit ip_pton _Z14ipaddr2devnamePcPK7in_addr replacenonprintable _ZN10ServiceNFOC1EP9AllProbes _ZN9__gnu_cxxneIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ _ZN10ServiceNFO11resetProbesEb _ZNSt4listIP12dns_server_sSaIS1_EE5beginEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEEC2ERKS5_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEED2Ev _ZNKSt6vectorIPKcSaIS1_EE5beginEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEE8allocateEjPKv _ZN13UltraScanInfo20removeCompletedHostsEv _ZNSaISt10_List_nodeIP11host_elem_sEEC2ERKS3_ _ZNKSt6vectorI9probespecSaIS0_EE3endEv _ZNSt24__copy_backward_dispatchIPP17ServiceProbeMatchS2_11__true_typeE4copyEPKS1_S6_S2_ _ZN10UltraProbe10setConnectEt _Z16broadcast_socketi pcap_realloc _ZNSt6vectorIP6TargetSaIS1_EE9push_backERKS1_ _ZSt24__uninitialized_copy_auxIP9probespecS1_ET0_T_S3_S2_12__false_type _ZSt4findIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEtET_S7_S7_RKT0_ _ZnwjPv install_bpf_program pcap_nametonetaddr arp_delete _ZNKSt14_List_iteratorIP12dns_server_sEdeEv _Z15printportoutputP6TargetP8PortList _ZN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEC1ERKS1_ _ZSt13__destroy_auxIP9probespecEvT_S2_12__false_type _ZNSt20_List_const_iteratorIP12dns_server_sEppEv _ZSt10_ConstructIPKcS1_EvPT_RKT0_ optarg memset _Z12scantype2str5stype _ZN13UltraScanInfo18findIncompleteHostEP16sockaddr_storage _ZNSt14_List_iteratorIP11host_elem_sEC1EPSt15_List_node_base _ZNSt24__copy_backward_dispatchIPPKcS2_11__true_typeE4copyEPKS1_S6_S2_ _ZN9__gnu_cxx13new_allocatorIhEC2ERKS1_ _ZNSaISt10_List_nodeIP9request_sEEC1IS1_EERKSaIT_E _Z20seqidx2difficultystrm SSL_read _ZN7NmapOps2afEv __pcap_nametodnaddr execve _ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEC1ERKS3_ gh_list_init _ZNSspLEc _ZN9__gnu_cxxneIPPKcSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ gen_and _ZN17ServiceProbeMatchC1Ev _ZSt38__copy_backward_output_normal_iteratorIPPKcN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type _Z16ftp_anon_connectP7ftpinfo connect _ZNSt10_List_baseIP9request_sSaIS1_EE11_M_get_nodeEv pthread_once _ZSt10__copy_ni2IPP6TargetN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type _ZSt14__copy_trivialIP12ServiceProbeEPT_PKS2_S5_S3_ strstr _ZNSaIP13HostScanStatsEC1Ev perror _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type __xnet_sendto _ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE11_M_allocateEj _ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEppEv __xnet_getsockopt _ZNSt4listIP10ServiceNFOSaIS1_EE3endEv bpf_optimize _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_11__true_type pcap_nametoportrange _ZN9__gnu_cxxeqIPtSt6vectorItSaItEEEEbRKNS_17__normal_iteratorIT_T0_EESA_ _ZN14GroupScanStats6sendOKEv nsi_new _ZNSaISt10_List_nodeIP12dns_server_sEED1Ev _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_11__true_type _ZSt6fill_nIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEjhET_S7_T0_RKT1_ _ZSt8distanceISt20_List_const_iteratorIP9request_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_ _ZNSt12_Vector_baseItSaItEED2Ev _ZN13HostScanStats11nextPingSeqEb ERR_get_error _ZNSaIP10ServiceNFOEC1Ev gh_list_free _Z13log_flush_allv _ZSt8_DestroyIP9request_sEvPT_ _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type _ZNSaISt10_List_nodeIP9request_sEED2Ev _ZNSt6vectorIP6TargetSaIS1_EE4backEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEE10deallocateEPS4_j add_or_find_if get_event_id_type _ZSt8_DestroyIP13HostScanStatsEvPT_ _ZN15ConnectScanInfoC1Ev _ZNSaIPKcEC1Ev _ZNSt10_List_baseIP13HostScanStatsSaIS1_EE7_M_initEv _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EEC2ERKS2_ pcap_inject _ZN8ArpProbeC1Ev SSL_new _ZSt19__copy_backward_auxIPhS0_ET0_T_S2_S1_ _ZN15NmapOutputTable16addItemFormattedEjjPKcz _ZN13HostScanStatsD1Ev _ZNKSt6vectorI9probespecSaIS0_EE5beginEv _ZN7NmapOps15maxUDPScanDelayEv _ZSt14__copy_trivialIP6TargetEPT_PKS2_S5_S3_ _ZNSt4listIP13HostScanStatsSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ tcsetattr gh_perror _ZN18FingerPrintResults19getOSClassificationEv _ZN6Target6NameIPEv strpbrk _lib_version _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEED2Ev _ZN8PortListC2Ev gen_inbound _ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEppEi _ZSt19__iterator_categoryISt20_List_const_iteratorIP13HostScanStatsEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEED2Ev nsp_add_event _ZSt8_DestroyIPtEvT_S1_ ERR_error_string _ZNSaIP9request_sEC1Ev _ZNSaISt10_List_nodeIP11host_elem_sEED2Ev pcap_get_in _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEEvT_S7_ _ZSt10__copy_ni2IPP6TargetS2_ET0_T_S4_S3_12__false_type _ZN18FingerPrintResults27classAlreadyExistsInResultsEP17OS_Classification _ZN11TargetGroup10parse_exprEPKci _ZN7NmapOpsC2Ev _ZNSt4listIP9request_sSaIS1_EE5beginEv eth_pton handle_timer_result _ZN10UltraProbeD1Ev _ZSt8distanceISt20_List_const_iteratorIP13HostScanStatsEENSt15iterator_traitsIT_E15difference_typeES5_S5_ nsi_peerport _ZNSt4listIP10ServiceNFOSaIS1_EED1Ev _ZNSt6vectorI9probespecSaIS0_EE5eraseEN9__gnu_cxx17__normal_iteratorIPS0_S2_EES6_ _ZNSt6vectorIPKcSaIS1_EE3endEv _ZN13UltraScanInfoD2Ev ip_ntop SSL_load_error_strings _ZN6Target11targetipstrEv _ZSt10__distanceISt20_List_const_iteratorIP10UltraProbeEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag _ZSt10_ConstructIttEvPT_RKT0_ _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _Z12print_iflistv _ZNSt14_List_iteratorIP12dns_server_sEC1Ev _ZN9AllProbesC2Ev _ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE12_Vector_implC1ERKS2_ recvfrom _ZSt8_DestroyIP10ServiceNFOEvPT_ _Z14devname2ipaddrPcP7in_addr _ZN7NmapOps17setMaxHostGroupSzEj _ZN6Target14TargetSockAddrEP16sockaddr_storagePj _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type addr_ntop ip_ntoa _ZNK9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEdeEv gethostbyname _ZN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEppEv _ZSt14__copy_trivialIhEPT_PKS0_S3_S1_ addr_ntos nsock_read tcgetattr route_open _Z5hdumpPhj _ZNSt6vectorItSaItEED1Ev _ZSt14__copy_trivialIP17ServiceProbeMatchEPT_PKS2_S5_S3_ _Z17my_pcap_open_livePKciii _ZN17ScanProgressMeterC1EPc Nsock_SSL_Init _ZNKSt20_List_const_iteratorIP9request_sEneERKS2_ edges _ZSt19__copy_backward_auxIPP6TargetS2_ET0_T_S4_S3_ getopt _ZN6Target8v4hostipEv _environ _ZNSaISt10_List_nodeIP10UltraProbeEEC2ERKS3_ _ZN6Target10MACAddressEv getnameinfo _Z20compare_fingerprintsP10FingerTestS0_i _ZNSt12_Vector_baseIPKcSaIS1_EE12_Vector_implD1Ev _ZNSt10_List_baseIP12dns_server_sSaIS1_EE8_M_clearEv pthread_mutex_unlock _ZSt11__copy_aux2IP9probespecS1_ET0_T_S3_S2_12__false_type _ZN18FingerPrintResultsC1Ev _ZNSaIP10UltraProbeEC1Ev _ZN12ServiceProbeD1Ev pcap_read pthread_getspecific _ZNSt14_List_iteratorIP12dns_server_sEppEi pcap_freecode _ZNKSt20_List_const_iteratorIP10UltraProbeEneERKS2_ _ZNSt6vectorIhSaIhEE14_M_fill_insertEN9__gnu_cxx17__normal_iteratorIPhS1_EEjRKh localtime _ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE9push_backERKS1_ nsi_get1_ssl_session _Z12getfastprotsv _Z25parse_nmap_service_probesP9AllProbes _ZN12dns_server_sC1Ev _ZN17ServiceProbeMatchD2Ev strcasecmp _ZN12ServiceProbe9testMatchEPKhi _ZNSt6vectorIP12ServiceProbeSaIS1_EED1Ev _ZSt19__iterator_categoryISt20_List_const_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ get_new_event_id _ZNKSt14_List_iteratorIP12dns_server_sEeqERKS2_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEE10deallocateEPS4_j _ZN8PortList14getStateCountsEi eth_send _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZN14GroupScanStatsC2EP13UltraScanInfo addr_ntoa pcap_next _ZNSt4listIP10UltraProbeSaIS1_EE9push_backERKS1_ _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEEvT_S8_ _ZN9__gnu_cxx13new_allocatorIPKcED2Ev fcntl pcap_datalink_val_to_name _ZN13UltraScanInfo4InitERSt6vectorIP6TargetSaIS2_EEP10scan_lists5stype _ZSt8_DestroyIP10UltraProbeEvPT_ sscanf _Z22parse_fingerprint_filePc _ZNSt6vectorIhSaIhEE18_M_insert_dispatchIjEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S7_11__true_type __floatdidf sysinfo _ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EEC2ERKS2_ _ZNSt4listIP12dns_server_sSaIS1_EE14_M_create_nodeERKS1_ pcap_dump_flush _ZNSt4listIP11host_elem_sSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ strtok _ZNSt6vectorI9probespecSaIS0_EEC1ERKS1_ strtol _Z19send_tcp_raw_decoysiP7eth_nfoPK7in_addrittjjhtPhiPct ___errno socket_errno SSL_get_error mmap pcap_nametollc _ZNSt10_List_baseIP10UltraProbeSaIS1_EE8_M_clearEv _ZNSt12_Vector_baseI9probespecSaIS0_EE11_M_allocateEj _ZNSt6vectorItSaItEE3endEv _ZN9__gnu_cxxneIPP6TargetSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ _ZN7NmapOps10InitializeEv _ZN15ConnectScanInfoD2Ev _ZN7NmapOps12versionTraceEv _ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEC1ERKS3_ pcap_set_lineno _Z10log_vwriteiPKcPv _ZNKSt20_List_const_iteratorIP10ServiceNFOEneERKS2_ _ZN6Target14SourceSockAddrEP16sockaddr_storagePj _Z9seqreportP8seq_info _ZSt38__copy_backward_output_normal_iteratorIPhN9__gnu_cxx17__normal_iteratorIS0_St6vectorIhSaIhEEEEET0_T_S8_S7_11__true_type _ZN15NmapOutputTableD2Ev _ZN6Target13SrcMACAddressEv _ZN9__gnu_cxx17__normal_iteratorIPK9probespecSt6vectorIS1_SaIS1_EEEC1ERKS3_ strncat pcap_stats _Z9route_dstPK16sockaddr_storageP9route_nfo signal _Z14send_ip_packetiP7eth_nfoPhj _ZNSt4listIP13HostScanStatsSaIS1_EE5frontEv _ZNSt6vectorI9probespecSaIS0_EE8pop_backEv _ZN12ServiceProbe8addMatchEPKci _ZNSaIhEC1Ev _ZNSt10_List_baseIP13HostScanStatsSaIS1_EE8_M_clearEv _ZSt38__copy_backward_output_normal_iteratorIPP17ServiceProbeMatchN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type sleep _ZNSt10_List_baseIP10ServiceNFOSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE eth_ntoa _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type n_errors gen_ncode optopt _ZNSaIhED2Ev getpwuid _ZN10UltraProbeC2Ev _ZN6Target8timedOutEPK7timeval _ZN9__gnu_cxx13new_allocatorIP10UltraProbeEC2Ev next_vnode _Unwind_Resume strncpy _ZNSt6vectorIPKcSaIS1_EED1Ev _ZNSt6vectorIP17ServiceProbeMatchSaIS1_EEC1ERKS2_ _ZNSt6vectorIP12ServiceProbeSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ eth_ntop _Z24servicescan_read_handlerPvS_S_ nsi_id _ZNSt6vectorIP12ServiceProbeSaIS1_EE3endEv pcap_datalink _Z23pcap_recv_timeval_validv strncasecmp _ZNKSt14_List_iteratorIP12dns_server_sEneERKS2_ gen_less _ZNSt20_List_const_iteratorIP10UltraProbeEppEv _ZSt38__copy_backward_output_normal_iteratorIPtN9__gnu_cxx17__normal_iteratorIS0_St6vectorItSaItEEEEET0_T_S8_S7_11__true_type _ZN11TargetGroupC1Ev _ZNSaIP11host_elem_sEC1Ev _ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEdeEv _ZNSt6vectorIP6TargetSaIS1_EE5beginEv fs_clear _ZNSt12_Vector_baseIP6TargetSaIS1_EE13_M_deallocateEPS1_j read _ZNSt10_List_baseIP12dns_server_sSaIS1_EE10_List_implD1Ev getpid _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEEC2Ev _ZNSt6vectorIPKcSaIS1_EEixEj isspace _ZNKSt4listIP10ServiceNFOSaIS1_EE3endEv _ZN6Target10deviceNameEv nsock_tod _Z15adjust_timeouts7timevalP12timeout_info _ZSt19__iterator_categoryISt20_List_const_iteratorIP9request_sEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ _ZNSt10_List_baseIP10ServiceNFOSaIS1_EE7_M_initEv _ZNSt4listIP13HostScanStatsSaIS1_EE14_M_create_nodeERKS1_ Strncpy arp_open _ZN9__gnu_cxx13new_allocatorIP10ServiceNFOEC2Ev _ZNSt10_List_baseIP10UltraProbeSaIS1_EE10_List_implD1Ev _ZN9__gnu_cxx13new_allocatorIhED2Ev pcap__switch_to_buffer _ZNSt12_Vector_baseIhSaIhEE12_Vector_implC1ERKS0_ nsi_set_ssl_session strncmp _ZN9__gnu_cxx13new_allocatorI9probespecEC2Ev SSL_CTX_set_verify SSL_CTX_new nsock_event_cancel _ZSt7strpbrkPcPKc SSL_connect _ZN9__gnu_cxx13new_allocatorIPKcEC2ERKS3_ _ZN18FingerPrintResultsD2Ev _ZNSaISt10_List_nodeIP12dns_server_sEED2Ev _ZNKSt4listIP10ServiceNFOSaIS1_EE4sizeEv _ZSt11__copy_aux2IhEPT_S1_S1_S1_11__true_type _ZNKSt14_List_iteratorIP10UltraProbeEdeEv _ZN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEppEv _Znwj _ZN15NmapOutputTable7addItemEjjbPKci _ZNSt6vectorIP12ServiceProbeSaIS1_EE5beginEv _ZNSt12_Vector_baseIhSaIhEE11_M_allocateEj _ZN10ServiceNFO23currentprobe_timemsleftEPK7timeval gen_mtp3field_code _ZNK9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEdeEv _ZN12ServiceProbe15setProbeDetailsEPci _Z15getdefaultprotsv islower recv _ZSt4findISt14_List_iteratorIP10ServiceNFOES2_ET_S4_S4_RKT0_ _ZSt8distanceISt20_List_const_iteratorIP10UltraProbeEENSt15iterator_traitsIT_E15difference_typeES5_S5_ _ZNSt6vectorIP12ServiceProbeSaIS1_EEC1ERKS2_ _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZNKSt6vectorIP17ServiceProbeMatchSaIS1_EE3endEv _ZN9__gnu_cxx13new_allocatorIP6TargetEC2ERKS3_ ctime _ZNSt12_Vector_baseIPKcSaIS1_EE12_Vector_implC1ERKS2_ gen_pf_ruleset putenv route_get _ZN11PacketTrace8traceArpENS_10pdirectionEPKhjP7timeval addr_stob _ZN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEC1ERKS2_ environ _ZN12ConnectProbeC2Ev _ZSt10_ConstructIP12dns_server_sS1_EvPT_RKT0_ _Z27servicescan_connect_handlerPvS_S_ _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ pcap_set_datalink optind _ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEC1ERKS3_ _Z4SendiPKvji _ZN8ArpProbeC2Ev _ZN9__gnu_cxxmiIPKtS2_St6vectorItSaItEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS9_RKNS6_IT0_S8_EE _ZN12ServiceGroupD1Ev SSL_shutdown _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_12__false_type _ZN14GroupScanStatsD2Ev _Z10tval2msecsPc _ZNSt12_Vector_baseIPKcSaIS1_EE11_M_allocateEj _ZN9__gnu_cxx13new_allocatorIP6TargetE8allocateEjPKv _Z31gather_logfile_resumption_statePcPiPPS_ addr_ston _ZSt13__destroy_auxIPtEvT_S1_11__true_type _ZNKSt4listIP9request_sSaIS1_EE4sizeEv _ZSt13__destroy_auxIPPKcEvT_S3_11__true_type _Z12send_tcp_rawiP7eth_nfoPK7in_addrS3_ittjjhtPhiPct _ZSt9__advanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEjEvRT_T0_St26random_access_iterator_tag _Z12gettcpopt_tsP6tcphdrPjS1_ _ZNSt10_List_baseIP9request_sSaIS1_EE7_M_initEv _Z9log_closei addr_pton _ZN9__gnu_cxx13new_allocatorItE8allocateEjPKv _ZN8PortList10removePortEth _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEEEvT_S9_ _ZN7NmapOps15spoofMACAddressEv _ZN7NmapOps6ReInitEv _ZN18FingerPrintResults32fingerprintSuitableForSubmissionEv .div vmap .umul _ZNSt12_Vector_baseIP6TargetSaIS1_EE11_M_allocateEj getopt_long_only _Z14arg_parse_freePPc _ZSt10__copy_ni2IPPKcN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type add_addr_to_iflist pcap_get_lineno gen_portop _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEE8allocateEjPKv errno _ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEC1Ev _ZNSt4listIP10ServiceNFOSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E _Z16eth_close_cachedv _ZNSt6vectorIP6TargetSaIS1_EEixEj pow _ZN7IPProbeD2Ev _ZNSt14_List_iteratorIP10UltraProbeEmmEi _ZN13HostScanStats17markProbeTimedoutESt14_List_iteratorIP10UltraProbeE pcap_dump_ftell fs_free _ZN9__gnu_cxx13new_allocatorIP12ServiceProbeE10deallocateEPS2_j _ZN15NmapOutputTable11getCellAddyEjj _Z14nmap_mass_rdnsPP6Targeti error _ZNKSt4listIP10ServiceNFOSaIS1_EE5emptyEv _ZNSt6vectorI9probespecSaIS0_EE6insertIN9__gnu_cxx17__normal_iteratorIPS0_S2_EEEEvS7_T_S8_ _ZN8PortList16numIgnoredStatesEv _ZN10UltraProbe5sportEv _ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE3endEv nsp_settrace _ZNSaISt10_List_nodeIP10ServiceNFOEED2Ev pcap__scan_string _ZN11TargetGroup6rewindEv _ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEC1Ev _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_ _ZN6Target7nextHopEP16sockaddr_storagePj _ZN6Target16setSrcMACAddressEPKh _ZNSt12_Vector_baseIPKcSaIS1_EED2Ev _ZNKSt14_List_iteratorIP10ServiceNFOEdeEv _ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEppEi route_delete _ZNSt6vectorIhSaIhEED1Ev _Z6genfryPhii strlcpy pcap_nametoaddr _ZNKSt4listIP9request_sSaIS1_EE5emptyEv pcap_compile gh_list_remove_elem dup_sockaddr pcap_findalldevs _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEEC2ERKS5_ _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _ZSt8_DestroyIPP12ServiceProbeEvT_S3_ gh_list_prepend _Z16numberlist2arrayPcPtiPS_tt SSL_get_session _ZN7NmapOps17initialRttTimeoutEv _ZNKSt14_List_iteratorIP9request_sEeqERKS2_ _ZNSt14_List_iteratorIP13HostScanStatsEC1EPSt15_List_node_base _Z15freeFingerPrintP10FingerTest RAND_seed __deregister_frame_info _Z18getInterfaceByNamePc _ZN9__gnu_cxx13new_allocatorIP9request_sED2Ev _ZSt8_DestroyIP6TargetEvPT_ _ZNKSt4listIP13HostScanStatsSaIS1_EE4sizeEv _ZNSt4listIP12dns_server_sSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ _ZNSt10_List_baseIP9request_sSaIS1_EE10_List_implD1Ev _ZSt10__distanceISt20_List_const_iteratorIP9request_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag _ZN9__gnu_cxxmiIPKhS2_St6vectorIhSaIhEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS9_RKNS6_IT0_S8_EE get_random_uint _ZNSt4listIP13HostScanStatsSaIS1_EE9pop_frontEv _ZNSaIP12ServiceProbeED1Ev exit _Z15eth_open_cachedPKc msevent_delete _ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEC1Ev _ZSt11__copy_aux2ItEPT_S1_S1_S1_11__true_type nse_iod _ZN11TargetGroup10InitializeEv _ZNSt10_List_baseIP11host_elem_sSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE _PROCEDURE_LINKAGE_TABLE_ addr_btos pcap_setnonblock_fd freeaddrinfo _ZNSt20_List_const_iteratorIP10ServiceNFOEppEv handle_connect_result _ZNSt10_List_baseIP9request_sSaIS1_EED2Ev gh_list_pop _ZNSt10_List_baseIP12dns_server_sSaIS1_EE7_M_initEv _ZNSt4listIP10ServiceNFOSaIS1_EE5eraseESt14_List_iteratorIS1_E _ZN9__gnu_cxx13new_allocatorIP13HostScanStatsED2Ev _ZN7IPProbe5ResetEv gen_vlan _ZN9__gnu_cxx17__normal_iteratorIPKP12ServiceProbeSt6vectorIS2_SaIS2_EEEC1ERKS4_ _ZNSt12_Vector_baseI9probespecSaIS0_EED2Ev usleep gen_broadcast _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type _ZSt26__uninitialized_fill_n_auxIPhjhET_S1_T0_RKT1_11__true_type _ZN6TargetD1Ev _ZN9__gnu_cxx13new_allocatorItED2Ev SSL_set_fd _ZNKSt6vectorIP12ServiceProbeSaIS1_EE5beginEv _ZN13HostScanStats14boostScanDelayEv _ZN9__gnu_cxxeqIPK9probespecSt6vectorIS1_SaIS1_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ pcap_alloc _ZN13HostScanStats9getTimingEP17ultra_timing_vals _iob _ZN12ConnectProbeD1Ev _ZNSt4listIP11host_elem_sSaIS1_EEC1ERKS2_ _ZN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEpLERKi addr_cmp pcap_getnonblock _ZN14HostGroupStateC2EiiPPci _ZNSt10_List_baseIP11host_elem_sSaIS1_EE8_M_clearEv _Z22put_dns_packet_on_wireP9request_s _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type pcap_nametoproto _Z17random_port_cheatPti gen_loadi _Z11dumpExcludeP11TargetGroup _ZN9__gnu_cxx13new_allocatorI9probespecEC2ERKS2_ _ZNSt14_List_iteratorIP10UltraProbeEC1Ev __getopt_initialized _ZN6Target17setSourceSockAddrEP16sockaddr_storagej _ZN7NmapOps2pfEv nse_type _ZNKSt6vectorIhSaIhEE4sizeEv nsock_trace_handler_callback addr_btom _ZN13HostScanStats12allowedTrynoEPbS0_ _ZNSt6vectorIPKcSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ _ZNSt10_List_baseIP10ServiceNFOSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_11__true_type _Z13build_udp_rawP7in_addrPKS_itttPctPj __register_frame_info _ZNSt20_List_const_iteratorIP9request_sEppEv _ZNSt4listIP13HostScanStatsSaIS1_EE5eraseESt14_List_iteratorIS1_E _ZNSt20_List_const_iteratorIP10UltraProbeEC1EPKSt15_List_node_base _ZNKSt6vectorIPKcSaIS1_EE3endEv _ZNSaIP17ServiceProbeMatchED1Ev _ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEppEv _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEEvT_S7_11__true_type _ZdaPv get_random_u16 nsi_delete vnode_base _ZN14HostGroupStateC1EiiPPci arp_get _ZN7NmapOps15maxTCPScanDelayEv _ZN7NmapOps15setVersionTraceEb _ZN6Target7RecycleEv _ZN12ServiceProbe17serviceIsPossibleEPKc _ZN12ServiceProbe9setRarityEPKci .rem _ZN9__gnu_cxxmiIPhS1_St6vectorIhSaIhEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS8_RKNS5_IT0_S7_EE _ZNSt6vectorIP12ServiceProbeSaIS1_EE9push_backERKS1_ _ZSt19__copy_backward_auxIP9probespecS1_ET0_T_S3_S2_ _ZSt6fill_nIjEPhS0_T_RKh space _Z10returnhostP14HostGroupState _ZN8ArpProbe5ResetEv geteuid _ZNSt4listIP11host_elem_sSaIS1_EE3endEv _ZNSt4listIP10UltraProbeSaIS1_EE5eraseESt14_List_iteratorIS1_E get_random_u32 eth_close _ZNSaIP12dns_server_sED1Ev _ZNKSt4listIP13HostScanStatsSaIS1_EE5beginEv _Z8recvtimeiPciiPi _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_11__true_type strftime nsi_getlastcommunicationinfo _ZN8PortList8nextPortEP4Portii _ZN12ServiceProbe14getProbeStringEPi _ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEdeEv srand _Z16cstring_unescapePcPj _Z7resolvePcP7in_addr nse_id getaddrinfo _Z11islocalhostPK7in_addr pthread_mutex_lock _Jv_RegisterClasses _ZSt10_ConstructIP12ServiceProbeS1_EvPT_RKT0_ _ZNSt14_List_iteratorIP10UltraProbeEppEi _ZN13HostScanStats12probeTimeoutEv getc pcap_setfilter SSLv23_client_method _ZN9__gnu_cxxmiIPtS1_St6vectorItSaItEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS8_RKNS5_IT0_S7_EE pcap_get_text _ZNSt6vectorItSaItEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPtS1_EERKt _ZN9__gnu_cxx13new_allocatorI9probespecE10deallocateEPS1_j _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _ZN10ServiceNFO28appendtocurrentproberesponseEPKhi _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEEC2Ev pcap_lex_destroy _ZNSt12_Vector_baseI9probespecSaIS0_EE12_Vector_implC1ERKS1_ SSL_write _ZN14GroupScanStatsD1Ev route_loop _ZNK9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEE4baseEv get_random_bytes _ZNKSt4listIP9request_sSaIS1_EE5beginEv _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_ _ZN6TargetC2Ev pcap_close _ZSt10_ConstructIP10ServiceNFOS1_EvPT_RKT0_ fread _ZNSt10_List_baseIP10UltraProbeSaIS1_EE7_M_initEv _ZNSt4listIP12dns_server_sSaIS1_EE3endEv _ZN9__gnu_cxx17__normal_iteratorIPKP6TargetSt6vectorIS2_SaIS2_EEEC1ERKS4_ pcap_breakloop _ZN4PortC1Ev _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_ _Z8cp_alloci _ZNSt10_List_baseIP13HostScanStatsSaIS1_EE11_M_get_nodeEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEE10deallocateEPS4_j main _ZNKSs5c_strEv pthread_create _ZN9__gnu_cxx13new_allocatorIhE8allocateEjPKv route_close _Z24sendrawtcpudppingqueriesiP10eth_handleP6TargetitP7timevalP8pingtune _ZN7NmapOps16setMaxRttTimeoutEi _ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE12_Vector_implD1Ev isxdigit _ZN6Target13setMACAddressEPKh _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEED2Ev _ZSt13__destroy_auxIPhEvT_S1_11__true_type _ZN10ServiceNFO12currentProbeEv _ZN4PortD2Ev _ZNSt10_List_baseIP11host_elem_sSaIS1_EE10_List_implD1Ev _ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchE8allocateEjPKv _Z11xml_convertPKc dup2 gen_loadlen _ZN12ServiceProbe9getRarityEv _ZNSt6vectorI9probespecSaIS0_EED1Ev _ZN17ServiceProbeMatch9InitMatchEPKci _Z19setTargetNextHopMACP6Target _ZN7IPProbeD1Ev _ZN14GroupScanStatsC1EP13UltraScanInfo pcap__delete_buffer _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ pcap_datalink_val_to_description ftell pcap_set_in _ZN13HostScanStats6sendOKEP7timeval msevent_dispatch_and_delete _ZN7NmapOps21getMaxRetransmissionsEv _ZNSt14_List_iteratorIP10ServiceNFOEC1Ev _Z12load_excludeP6__FILEPc _ZN8PortList8setIdStrEPKc _ZN15NmapOutputTableC2Eii _ZN10UltraProbe6tcpseqEv _ZNSt4listIP9request_sSaIS1_EE3endEv _ZNK9__gnu_cxx17__normal_iteratorIPKP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEE4baseEv msevent_new _ZNKSt6vectorItSaItEE3endEv getprotobyname _ZNKSt14_List_iteratorIP10UltraProbeEneERKS2_ _ZSt19__copy_backward_auxIPP17ServiceProbeMatchS2_ET0_T_S4_S3_ gen_arth _ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEC1ERKS3_ fprintf strcat _ZNK9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEmiERKi _ZN7NmapOps18setSpoofMACAddressEPh _ZNSsC1Ev _ZN12ServiceProbe7getNameEv _ZSt26__uninitialized_fill_n_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEjhET_S7_T0_RKT1_11__true_type _ZNSt12_Vector_baseIPKcSaIS1_EE13_M_deallocateEPS1_j _ZN7NmapOps8v4sourceEv _ZNKSt6vectorIhSaIhEE3endEv pcap_nerrs _ZNSaISt10_List_nodeIP11host_elem_sEEC1IS1_EERKSaIT_E _ZN9__gnu_cxxneIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ nsp_getud _ZNSt4listIP9request_sSaIS1_EE5frontEv _ZNKSt6vectorIP17ServiceProbeMatchSaIS1_EE5beginEv _ZNSt10_List_baseIP12dns_server_sSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE fflush _ZN12ServiceProbeC2Ev pcap_wrap _Z16tsseqclass2asciii _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_ _ZSt24__uninitialized_copy_auxIPP6TargetS2_ET0_T_S4_S3_11__true_type _ZN12ServiceGroupC2ERSt6vectorIP6TargetSaIS2_EEP9AllProbes _ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE13_M_deallocateEPS1_j _ZN17ScanProgressMeter22printStatsIfNeccessaryEdPK7timeval _ZN9AllProbes14getProbeByNameEPKci _ZNKSt14_List_iteratorIP9request_sEneERKS2_ _ZNSt12_Vector_baseI9probespecSaIS0_EEC2ERKS1_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEE8allocateEjPKv _ZN11TargetGroup8get_maskEv _ZNSaI9probespecED1Ev _ZN6Target14setDeviceNamesEPKcS1_ _ZN7NmapOps13maxRttTimeoutEv pcap_next_ex _ZNSt6vectorI9probespecSaIS0_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS0_S2_EERKS0_ no_optimize _ZSt8_DestroyIP9probespecEvT_S2_ pcap_lookupnet _DYNAMIC _ZN7NmapOps14setPacketTraceEb _ZN13UltraScanInfo6sendOKEP7timeval _ZNKSt6vectorIP6TargetSaIS1_EE3endEv nsock_trace _ZN17ScanProgressMeterD2Ev _ZNK9__gnu_cxx17__normal_iteratorIPKP6TargetSt6vectorIS2_SaIS2_EEE4baseEv _ZSt4findISt14_List_iteratorIP10ServiceNFOES2_ET_S4_S4_RKT0_St18input_iterator_tag ERR_reason_error_string _ZN11TargetGroup16return_last_hostEv _ZNKSt14_List_iteratorIP13HostScanStatsEneERKS2_ _ZSt10__copy_ni2IPP12ServiceProbeN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type _ZN13HostScanStats14freshPortsLeftEv arp_add _ZN6Target6NameIPEPcj fork pcap_restart _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_11__true_type _ZNSaIP6TargetEC1Ev _Z11init_socketi nsi_checkssl pcap_fileno _ZNSt6vectorI9probespecSaIS0_EE20_M_allocate_and_copyIPS0_EES4_jT_S5_ _ZSt19__iterator_categoryISt14_List_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ gen_atmtype_abbrev _Z8tty_initv _ZNSaIP6TargetED2Ev lex_cleanup _Z9nmap_mainiPPc _ZNKSt4listIP10UltraProbeSaIS1_EE3endEv _ZNSt4listIP10UltraProbeSaIS1_EE14_M_create_nodeERKS1_ pcap_strcasecmp _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_ rewind pcap_get_selectable_fd bpf_filter _ZN7NmapOps7TCPScanEv _ZN9__gnu_cxx13new_allocatorIPKcE8allocateEjPKv _ZNSt14_List_iteratorIP11host_elem_sEppEi _ZNSt14_List_iteratorIP10ServiceNFOEC1EPSt15_List_node_base _Z8mergeFPsPP10FingerTestiiiPKh _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEEEvT_S9_ _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEEEvT_S9_ _ZNKSt20_List_const_iteratorIP13HostScanStatsEneERKS2_ RAND_status tcgetpgrp dup _ZNSt12_Vector_baseItSaItEE13_M_deallocateEPtj _ZNSaISt10_List_nodeIP10UltraProbeEED2Ev __cxa_end_catch __pcap_atodn get_random_ushort __dso_handle _ZN7NmapOps14minHostGroupSzEv _ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE12_Vector_implC1ERKS2_ _ZNSt10_List_baseIP10ServiceNFOSaIS1_EEC2ERKS2_ _ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEppEi _ZNSt4listIP11host_elem_sSaIS1_EE10push_frontERKS1_ _ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEppEi _ZN8PortListD1Ev _ZNSaItEC1Ev SSL_set_session _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_11__true_type _ZN17ScanProgressMeterC2EPc nsock_unblock_socket _ZN4Port22setServiceProbeResultsE17serviceprobestatePKc19service_tunnel_typeS2_S2_S2_S2_S2_S2_S2_ _ZNSt24__copy_backward_dispatchIPP12ServiceProbeS2_11__true_typeE4copyEPKS1_S6_S2_ _ZNSt10_List_baseIP12dns_server_sSaIS1_EE11_M_get_nodeEv _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZNSt6vectorItSaItEE9push_backERKt _ZN11TargetGroup16get_targets_typeEv _ZNSt4listIP9request_sSaIS1_EED1Ev pcre_exec _ZNSt10_List_baseIP12dns_server_sSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E _ZN9__gnu_cxx13new_allocatorIP12ServiceProbeEC2Ev qsort _ZNKSt6vectorIP12ServiceProbeSaIS1_EE4sizeEv _ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEppEv strchr _ZN7NmapOpsD1Ev nsi_new2 _ZNSaItED2Ev _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEEC2Ev _ZN10UltraProbe2CPEv _ZNKSt4listIP10UltraProbeSaIS1_EE5beginEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEE10deallocateEPS4_j _Z12getfastportsii get_random_int _Z13keyWasPressedv _Z15ipidclass2asciii pcap__scan_bytes pcap_datalink_name_to_val _ZNSt10_List_baseIP10UltraProbeSaIS1_EED2Ev _ZSt10__copy_ni2IPP17ServiceProbeMatchN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type _ZNSt4listIP11host_elem_sSaIS1_EED1Ev putmsg _ZNSt12_Vector_baseIP6TargetSaIS1_EEC2ERKS2_ _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEEvT_S7_11__true_type blocks abort _Z9log_flushi _ZN7NmapOps17setSourceSockAddrEP16sockaddr_storagej pthread_mutex_trylock _Z18printStatusMessagev _ZN8PortList15numIgnoredPortsEv _ZNSt4listIP9request_sSaIS1_EE5eraseESt14_List_iteratorIS1_E _ZSt38__copy_backward_output_normal_iteratorIPP6TargetN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type nsock_readbytes gen_atmfield_code _ZN9__gnu_cxx13new_allocatorIP12dns_server_sEC2Ev _ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchED2Ev _ZN14HostGroupStateD2Ev _ZNSt6vectorIP6TargetSaIS1_EE20_M_allocate_and_copyIPS1_EES5_jT_S6_ pcap_open_live _ZNSaIP13HostScanStatsED1Ev _ZNSt10_List_baseIP13HostScanStatsSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E _ZSt8distanceISt20_List_const_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E15difference_typeES5_S5_ _ZN6Target16GenerateIPStringEv _ZNK9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEplERKi nse_readbuf _ZSt10__distanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEENSt15iterator_traitsIT_E15difference_typeES9_S9_St26random_access_iterator_tag gen_scode gh_list_append _ZNKSt4listIP10UltraProbeSaIS1_EE5emptyEv gen_pppoes setjmp pcap_char pcap_close_common __pcap_atoin _ZNSt4listIP12dns_server_sSaIS1_EED1Ev _Z12getsysroutesPi pcap_lookupdev _ZSt6__copyIP9probespecS1_ET0_T_S3_S2_St26random_access_iterator_tag _ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE12_Vector_implD1Ev _ZN9__gnu_cxx13new_allocatorItE10deallocateEPtj _ZN9__gnu_cxxneIPhSt6vectorIhSaIhEEEEbRKNS_17__normal_iteratorIT_T0_EESA_ _ZN13PacketCounterC1Ev _Z19read_arp_reply_pcapP4pcapPhP7in_addrlP7timeval _ZN6Target12FreeInternalEv _ZNK9__gnu_cxx17__normal_iteratorIPK9probespecSt6vectorIS1_SaIS1_EEE4baseEv _ZN10UltraProbe6setARPEPhj _Z19getFinalPacketStatsPci _ZNSt12_Vector_baseIhSaIhEED2Ev nsock_write getopt_long _ZN10ServiceNFO9nextProbeEb _ZNSt10_List_baseIP9request_sSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE gen_pf_ifname _ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ pcap_is_swapped _ZN8PortList7addPortEthPci strcmp _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEEC2ERKS5_ _ZSt38__copy_backward_output_normal_iteratorIP9probespecN9__gnu_cxx17__normal_iteratorIS1_St6vectorIS0_SaIS0_EEEEET0_T_S9_S8_11__true_type vsnprintf _etext _ZNSt4listIP13HostScanStatsSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E _ZSt11__copy_aux2IP17ServiceProbeMatchEPT_S3_S3_S3_11__true_type malloc socket _Z13get_rpc_procsPPmS_ _ZNSaISt10_List_nodeIP13HostScanStatsEED1Ev _ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEppEv _ZNSt14_List_iteratorIP11host_elem_sEC1Ev _ZNSt6vectorIhSaIhEE6insertIjEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S7_ _ZN7NmapOps5setafEi _ZSt11__copy_aux2IP6TargetEPT_S3_S3_S3_11__true_type _ZSt8_DestroyI9probespecEvPT_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEEC2Ev _ZN15idle_proxy_infoD1Ev _ZNSt6vectorIP6TargetSaIS1_EE7reserveEj _ZNSaIP9request_sED1Ev _ZSt7advanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEjEvRT_T0_ _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _ZN10ServiceNFO21getServiceFingerprintEPi _ZNSt20_List_const_iteratorIP10ServiceNFOEC1EPKSt15_List_node_base _Z12end_svcprobePv17serviceprobestateP12ServiceGroupP10ServiceNFOS_ _ZN10UltraProbe5dportEv _ZN6Target8HostNameEv _ZNSaISt10_List_nodeIP11host_elem_sEED1Ev _ZNSt4listIP10UltraProbeSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E _ZSt10_ConstructIP6TargetS1_EvPT_RKT0_ _ZNK9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEE4baseEv arp_loop _ZN12ServiceProbe14portIsProbableE19service_tunnel_typet _ZSt15__copy_backwardIP9probespecS1_ET0_T_S3_S2_St26random_access_iterator_tag _ZNSt14_List_iteratorIP9request_sEppEv gh_list_remove _Z17printosscanoutputP6Target _Z6optcmpPKcS0_ _ZN13UltraScanInfoC2Ev _ZNSt14_List_iteratorIP10UltraProbeEC1EPSt15_List_node_base pcap_file _ZN15NmapOutputTable14printableTableEPi pcap_pop_buffer_state _ZSt10__copy_ni2IPtN9__gnu_cxx17__normal_iteratorIS0_St6vectorItSaItEEEEET0_T_S8_S7_11__true_type _ZN7IPProbe11storePacketEPhj _ZN9AllProbesD2Ev _ZNSt10_List_baseIP10ServiceNFOSaIS1_EE10_List_implD1Ev _ZN10ServiceNFO16addServiceStringEPci _ZN7NmapOps10v4sourceipEv _ZN13UltraScanInfoD1Ev _ZN9__gnu_cxx13new_allocatorItEC2ERKS1_ _ZN11PacketTrace5traceENS_10pdirectionEPKhjP7timeval _ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEE4baseEv open pcap_perror _ZN9__gnu_cxx13new_allocatorIP6TargetED2Ev nsp_delete isatty _ZNSt14_List_iteratorIP9request_sEppEi RAND_pseudo_bytes _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEEvT_S7_ strcpy pcap_lex _ZN9AllProbesC1Ev _Z15get_rpc_resultsP6TargetP8portinfoP9scanstatsP12portinfolistP11rpcscaninfo getenv _ZN9__gnu_cxx13new_allocatorIP11host_elem_sEC2Ev _ZNKSt4listIP12dns_server_sSaIS1_EE5beginEv _ZN6Target20setDirectlyConnectedEb setsockopt _ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchEC2ERKS3_ _ZNSt6vectorI9probespecSaIS0_EE7reserveEj _Z14xml_sf_convertPKc close _Z16getInterfaceByIPP16sockaddr_storage nsock_gettimeofday isprint _ZN6Target17NextHopMACAddressEv _Z16adjust_timeouts2PK7timevalS1_P12timeout_info _Z9log_writeiPKcz _ZNSt6vectorI9probespecSaIS0_EE3endEv _Z17match_fingerprintP10FingerTestP18FingerPrintResultsPS0_d _ZSt19__copy_backward_auxIPPKcS2_ET0_T_S4_S3_ _Z22printserviceinfooutputP6Target _ZNKSt6vectorI9probespecSaIS0_EE5emptyEv _ZSt13__destroy_auxIPP12ServiceProbeEvT_S3_11__true_type setrlimit gen_pf_rnr _ZN13HostScanStats9completedEv pcap_in _ZNSt10_List_baseIP10UltraProbeSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE gen_pppoed _ZNSt10_List_baseIP9request_sSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E Nsock_SSLGetInfo _ZN12ServiceProbeC1Ev _ZN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEppEv fgets _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_11__true_type _Z18nmap_getservbyportiPKc _ZNSt4listIP10ServiceNFOSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ _ZN17ServiceProbeMatchC2Ev _ZSt10__copy_ni2IPhN9__gnu_cxx17__normal_iteratorIS0_St6vectorIhSaIhEEEEET0_T_S8_S7_11__true_type _Z12service_scanRSt6vectorIP6TargetSaIS1_EE _ZN7NmapOps13XSLStyleSheetEv _ZNKSt4listIP10UltraProbeSaIS1_EE4sizeEv _ZN9__gnu_cxxmiIPKP17ServiceProbeMatchS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE _Z13readtcppacketPKhi _start _ZN17ServiceProbeMatchD1Ev _ZN6Target9setIfTypeE7devtype _ZN9__gnu_cxx13new_allocatorIPKcEC2Ev _ZSt10_ConstructIP10UltraProbeS1_EvPT_RKT0_ __cmpdi2 gen_load _ZNSt12_Vector_baseIhSaIhEEC2ERKS0_ _ZSt18uninitialized_copyIPhS0_ET0_T_S2_S1_ _Z12send_udp_rawiP7eth_nfoP7in_addrPKS1_itttPct handle_read_result pcap__flex_debug _ZNSt4listIP9request_sSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E _ZNSt4listIP10ServiceNFOSaIS1_EE5beginEv _ZNK9__gnu_cxx17__normal_iteratorIPKPKcSt6vectorIS2_SaIS2_EEE4baseEv _ZNSt20_List_const_iteratorIP13HostScanStatsEC1EPKSt15_List_node_base _ZNSaISt10_List_nodeIP13HostScanStatsEEC1IS1_EERKSaIT_E _edata _Z13readudppacketPKhi _Z26get_connecttcpscan_resultsP12tcpqueryinfoPP6TargetP7timevalP8pingtuneP12timeout_info _ZN7NmapOps18setMaxUDPScanDelayEj gen_relation eth_set _ZNSt10_List_baseIP13HostScanStatsSaIS1_EED2Ev _ZNK9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEE4baseEv _ZNSt6vectorIP6TargetSaIS1_EEC1ERKS2_ _ZNKSt6vectorIPKcSaIS1_EE4sizeEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEEC2ERKS5_ _ZNSaIP10ServiceNFOED1Ev _ZNSt10_List_baseIP12dns_server_sSaIS1_EED2Ev _ZN10ServiceNFO23addToServiceFingerprintEPKcPKhi nse_type2str pcap_dump_file _Z12statenum2stri _ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEmiERKi _ZN15ConnectScanInfoC2Ev _Z6max_sdv pthread_key_delete nsp_getid _ZN9__gnu_cxxmiIPK9probespecS3_St6vectorIS1_SaIS1_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSA_RKNS7_IT0_S9_EE _exit _ZNSt12_Vector_baseI9probespecSaIS0_EE13_M_deallocateEPS0_j _Z24parse_single_fingerprintPc _ZN6Target20setNextHopMACAddressEPKh _ZNSt4listIP10UltraProbeSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ _ZN15ConnectScanInfoD1Ev _ZNSaIPKcED1Ev _ZSt19__iterator_categoryIP9probespecENSt15iterator_traitsIT_E17iterator_categoryERKS3_ _ZNSt6vectorIP17ServiceProbeMatchSaIS1_EED1Ev SSL_CTX_set_timeout _ZN7NmapOps7UDPScanEv _ZN8ArpProbeD1Ev eth_open nsp_setud _ZN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEC1ERKS1_ _Z20nmap_getrpcnamebynumm pcap_lib_version _ZNSt10_List_baseIP11host_elem_sSaIS1_EE11_M_get_nodeEv pcap_free ffs filespace_init _ZSt19__copy_backward_auxIPtS0_ET0_T_S2_S1_ _ZNK9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEE4baseEv _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEEC2Ev icode_to_fcode _ZN8PortListD2Ev _Z14seqclass2asciii _ZN10ServiceNFOD1Ev _ZNKSt4listIP9request_sSaIS1_EE3endEv __cxa_rethrow _ZN10UltraProbeD2Ev stringisprintable _ZN11TargetGroup10skip_rangeENS_11_octet_numsE _ZN7NmapOpsD2Ev _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _ZNK9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEdeEv pcap_dump __iob _Z15mac_prefix_initv _ZN10UltraProbeC1Ev _ZSt10_ConstructIP17ServiceProbeMatchS1_EvPT_RKT0_ _ZNKSt6vectorI9probespecSaIS0_EE8capacityEv _ZSt24__uninitialized_copy_auxIPhS0_ET0_T_S2_S1_11__true_type eproto_db _ZNSt4listIP10UltraProbeSaIS1_EEC1ERKS2_ nse_errorcode _ZNSt4listIP10ServiceNFOSaIS1_EE9pop_frontEv _ZSt10_ConstructIP11host_elem_sS1_EvPT_RKT0_ getrlimit _ZNSaIP11host_elem_sED1Ev _ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_11__true_type _ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEE4baseEv _ZNSaIPKcEC2ERKS1_ pcap_setnonblock _ZSt19__iterator_categoryISt20_List_const_iteratorIP10UltraProbeEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ _ZNSt10_List_baseIP10ServiceNFOSaIS1_EE11_M_get_nodeEv _ZNSt12_Vector_baseItSaItEE11_M_allocateEj _Z22determineScanGroupSizeiP10scan_lists getsockopt _ZN13UltraScanInfoC1ERSt6vectorIP6TargetSaIS2_EEP10scan_lists5stype ispunct _ZN15ConnectScanInfo7clearSDEi _Z5chompPc _ZSt8_DestroyIP12dns_server_sEvPT_ _ZNSt4listIP9request_sSaIS1_EEC1ERKS2_ sprintf getsockname _ZN9__gnu_cxx13new_allocatorIhEC2Ev _ZN14HostGroupStateD1Ev _Z8fp2asciiP10FingerTest _Z19send_frag_ip_packetiP7eth_nfoPhjj bpf_error opterr nsock_printf _ZSt14__copy_trivialItEPT_PKS0_S3_S1_ memcmp _ZNSt4listIP10ServiceNFOSaIS1_EE14_M_create_nodeERKS1_ _ZN17ScanProgressMeter10printStatsEdPK7timeval pcap_loop _ZN18FingerPrintResultsC2Ev pcap_geterr _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type _ZNSt10_List_baseIP10UltraProbeSaIS1_EEC2ERKS2_ __ctype _ZNKSt6vectorI9probespecSaIS0_EE4sizeEv _ZSt8_DestroyIPP17ServiceProbeMatchEvT_S3_ ether_hostton _ZNSt4listIP9request_sSaIS1_EE10push_frontERKS1_ _Z12inet_socktopP16sockaddr_storage _ZN18FingerPrintResultsD1Ev _ZNSt12_Vector_baseItSaItEE12_Vector_implC1ERKS0_ _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _ZNSaIP10UltraProbeED1Ev pcap__flush_buffer _Z19sendrawudppingqueryiP7eth_nfoP6TargetttP7timevalP8pingtune _ZNSt6vectorI9probespecSaIS0_EE18_M_insert_dispatchIN9__gnu_cxx17__normal_iteratorIPS0_S2_EEEEvS7_T_S8_12__false_type _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ gai_strerror pcap_lval _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_ _ZN9__gnu_cxx17__normal_iteratorIPKhSt6vectorIhSaIhEEEC1ERKS2_ _ZNSt10_List_baseIP11host_elem_sSaIS1_EE7_M_initEv nse_eof _ZN8PortList8port_mapE _ZN8PortList14isIgnoredStateEi _ZSt8_DestroyIhEvPT_ _ZN18FingerPrintResults22populateClassificationEv _ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEEvT_S8_12__false_type pcap_text pcap_offline_read _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES3_ET0_T_S9_S8_12__false_type _ZN9__gnu_cxxneIP9probespecSt6vectorIS1_SaIS1_EEEEbRKNS_17__normal_iteratorIT_T0_EESB_ _Z8nexthostP14HostGroupStateP11TargetGroupP10scan_listsPi nsock_loop pcap_get_debug _ZSt19__iterator_categoryIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEENSt15iterator_traitsIT_E17iterator_categoryERKS8_ _ZN6Target17setTargetSockAddrEP16sockaddr_storagej _ZN6Target10setNextHopEP16sockaddr_storagej addr_mtob _ZN7NmapOps16setXSLStyleSheetEPc _ZN7NmapOps14SourceSockAddrEP16sockaddr_storagePj _ZNKSt14_List_iteratorIP10ServiceNFOEneERKS2_ _ZSt13__destroy_auxIPP6TargetEvT_S3_11__true_type _ZNSaISt10_List_nodeIP10UltraProbeEEC1IS1_EERKSaIT_E _end _Z8log_openiiPc _ZN10UltraProbe4ipidEv _Z9cp_strdupPKc _ZN13UltraScanInfo15numInitialHostsEv sdup handle_write_result _Z27output_xml_scaninfo_recordsP10scan_lists _Z8in_cksumPti _ZNK9__gnu_cxx17__normal_iteratorIPKP12ServiceProbeSt6vectorIS2_SaIS2_EEE4baseEv _ZN13HostScanStats11nextTimeoutEP7timeval memcpy __eprintf _ZN10ServiceNFO23getcurrentproberesponseEPi gethostname _ZNSt4listIP11host_elem_sSaIS1_EE5beginEv addr_net safe_malloc pcap_open_offline _ZNSt10_List_baseIP10ServiceNFOSaIS1_EED2Ev _Z13build_tcp_rawPK7in_addrS1_itttjjhtPhiPctPj _Z15getdefaultportsii _ZNKSt6vectorIP6TargetSaIS1_EE8max_sizeEv _ZSt10_ConstructIP9request_sS1_EvPT_RKT0_ rand _ZSt18uninitialized_copyIPP6TargetS2_ET0_T_S4_S3_ fclose _ZNSt14_List_iteratorIP9request_sEC1EPSt15_List_node_base _ZNSt6vectorIhSaIhEEC1ERKS0_ ioctl _Z23setTargetMACIfAvailableP6TargetP11link_headerP2ipi _ZN7IPProbeC2Ev _Z11send_ip_rawiP7eth_nfoP7in_addrPKS1_ihPct bpf_validate _Z14send_rpc_queryPK7in_addrtimii _ZN12ServiceProbe16setProbablePortsE19service_tunnel_typePKci pcap_parse _Z13readhoststatei _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ __cxa_begin_catch pcap_platform_finddevs _ZSt10__copy_ni2IPhS0_ET0_T_S2_S1_12__false_type _ZNSt14_List_iteratorIP13HostScanStatsEppEi gen_acode _Z17nmap_getprotbynumi gen_portrangeop _ZSt4findIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEtET_S7_S7_RKT0_St26random_access_iterator_tag _ZN12ServiceProbe11isNullProbeEv isalnum getnetbyname write _Z6getptsPc getservbyname _ZNSt6vectorI9probespecSaIS0_EE5beginEv _ZNSaIhED1Ev _ZSt10__copy_ni2IP9probespecN9__gnu_cxx17__normal_iteratorIS1_St6vectorIS0_SaIS0_EEEEET0_T_S9_S8_11__true_type _Z14nmap_fetchfilePciS_ _ZNSt4listIP10ServiceNFOSaIS1_EE9push_backERKS1_ _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type nsi_getsd _ZNSt10_List_baseIP11host_elem_sSaIS1_EED2Ev _ZN9__gnu_cxx13new_allocatorIP10UltraProbeED2Ev addr_bcast _ZN9__gnu_cxx17__normal_iteratorIPKP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEC1ERKS4_ _ZN11TargetGroupC2Ev fileno pcap_leng _ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE11_M_allocateEj _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZN6Target8v4sourceEv _ZN8PortList16nextIgnoredStateEi _ZNSt4listIP9request_sSaIS1_EE5clearEv _ZSt19__copy_backward_auxIPP12ServiceProbeS2_ET0_T_S4_S3_ _ZNK9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEE4baseEv pcap_dispatch _ZNSaIP12ServiceProbeEC2ERKS1_ _ZNSt4listIP10UltraProbeSaIS1_EED1Ev _ZN9__gnu_cxx17__normal_iteratorIPKtSt6vectorItSaItEEEC1ERKS2_ _ZN7NmapOps15ValidateOptionsEv _ZNKSt14_List_iteratorIP9request_sEdeEv _ZN6Target10v4sourceipEv strerror _ZNSt4listIP12dns_server_sSaIS1_EE10push_frontERKS1_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEED2Ev _Z22encoded_name_to_normalPhPci _ZSt19__iterator_categoryIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEENSt15iterator_traitsIT_E17iterator_categoryERKS9_ nsi_getud _Z10ultra_scanRSt6vectorIP6TargetSaIS1_EEP10scan_lists5stype gen_pf_action _ZN9AllProbes10isExcludedEti pcap_list_datalinks _Z23initialize_timeout_infoP12timeout_info _ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE13_M_deallocateEPS1_j _ZNSt24__copy_backward_dispatchIPhS0_11__true_typeE4copyEPKhS4_S0_ gen_pf_reason _ZNSt10_List_baseIP9request_sSaIS1_EE8_M_clearEv _ZN13HostScanStats15retransmitBenchEv _ZN9__gnu_cxx13new_allocatorIP10ServiceNFOED2Ev gen_multicast _ZN13HostScanStats16moveProbeToBenchESt14_List_iteratorIP10UltraProbeE _ZN9__gnu_cxx17__normal_iteratorIPKPKcSt6vectorIS2_SaIS2_EEEC1ERKS4_ pcap_open_dead _ZSt10_ConstructIP13HostScanStatsS1_EvPT_RKT0_ _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_11__true_type _ZN9__gnu_cxx13new_allocatorI9probespecED2Ev _ZN6Target11setHostNameEPc nsock_connect_tcp _Z21printinteractiveusagev .udiv safe_zalloc _GLOBAL_OFFSET_TABLE_ _ZN6Target17startTimeOutClockEPK7timeval _ZN17ServiceProbeMatch9testMatchEPKhi pcap_get_leng _Z23close_rpc_query_socketsv _ZNSt10_List_baseIP10ServiceNFOSaIS1_EE8_M_clearEv _Z8mmapfilePcPii _ZN13HostScanStats12dismissBenchEv fopen _ZN9__gnu_cxx13new_allocatorItEC2Ev strdup _ZN9AllProbes16compileFallbacksEv _ZSt11__copy_aux2IPKcEPT_S3_S3_S3_11__true_type _ZNKSt6vectorIP6TargetSaIS1_EE5emptyEv _ZNKSt4listIP12dns_server_sSaIS1_EE4sizeEv _ZSt8distanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEENSt15iterator_traitsIT_E15difference_typeES9_S9_ _Z6reaperi _ZNSt12_Vector_baseI9probespecSaIS0_EE12_Vector_implD1Ev _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEE8allocateEjPKv _ZNSt20_List_const_iteratorIP12dns_server_sEC1EPKSt15_List_node_base _ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchE10deallocateEPS2_j _ZN9__gnu_cxx13new_allocatorI9probespecE8allocateEjPKv _Z12build_ip_rawPK7in_addrS1_ihtPctPj _ZN12ConnectProbeC1Ev _ZN7NmapOps7RawScanEv pfatal eth_get SSL_SESSION_free send _ZN12ServiceGroupD2Ev _ZN12ConnectProbeD2Ev _ZNSt4listIP9request_sSaIS1_EE6removeERKS1_ pcap_nametoeproto _ZNSaIPKcED2Ev pcre_compile free _ZNSt10_List_baseIP13HostScanStatsSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE _ZN8ArpProbeD2Ev _ZNSt10_List_baseIP10UltraProbeSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E gen_ecode route_add _ZNSt4listIP10UltraProbeSaIS1_EE3endEv _ZNSt12_Vector_baseIhSaIhEE12_Vector_implD1Ev _ZNK9__gnu_cxx17__normal_iteratorIPKtSt6vectorItSaItEEE4baseEv _ZN7NmapOps16setMinRttTimeoutEi SSL_free gen_mpls levels __xnet_bind _ZN12ServiceProbe14setProbeStringEPKhi gen_atmmulti_abbrev _ZN10ServiceNFOD2Ev _ZN11TargetGroup13get_next_hostEP16sockaddr_storagePj _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEEC2ERKS5_ _getopt_internal _ZNSaIP17ServiceProbeMatchEC1Ev nsock_connect_ssl pcap_nametoport _ZNSt12_Vector_baseIPKcSaIS1_EEC2ERKS2_ snprintf _ZSt19__iterator_categoryISt20_List_const_iteratorIP12dns_server_sEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ _ZSt8_DestroyIP11host_elem_sEvPT_ _ZNSt6vectorIhSaIhEE3endEv _ZNKSt14_List_iteratorIP13HostScanStatsEeqERKS2_ _ZNSt10_List_baseIP10UltraProbeSaIS1_EE11_M_get_nodeEv _ZN10ServiceNFOC2EP9AllProbes _ZNSt14_List_iteratorIP13HostScanStatsEC1Ev _ZSt4copyIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZN9__gnu_cxx13new_allocatorIPKcE10deallocateEPS2_j _ZSt6strchrPci _ZNSt4listIP10ServiceNFOSaIS1_EEC1ERKS2_ _Z8pos_scanP6TargetPti5stype munmap _ZNSaISt10_List_nodeIP10ServiceNFOEED1Ev _ZN9__gnu_cxxmiIP9probespecS2_St6vectorIS1_SaIS1_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS9_RKNS6_IT0_S8_EE nse_status2str _ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEEEvT_S9_ memmove pcap_freealldevs _Z19send_udp_raw_decoysiP7eth_nfoPK7in_addritttPct pcap_fopen_offline _fini _ZNSt12_Vector_baseIP6TargetSaIS1_EED2Ev _ZN4Port18setRPCProbeResultsEimjj _ZSt4copyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_ _ZN17ServiceProbeMatch13getVersionStrEPKhiPiiPciS3_iS3_iS3_iS3_iS3_i _ZSt10__copy_ni1IPP6TargetS2_ET0_T_S4_S3_12__false_type _Z13sethdrincludei _ZN7NmapOps16TimeSinceStartMSEP7timeval _ZN13HostScanStats11probeExpireEv _ZNSt6vectorItSaItEE5beginEv _ZN9__gnu_cxxmiIPKPKcS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE pcap_strerror _Z14MACCorp2PrefixPKcPh _ZNKSt4listIP13HostScanStatsSaIS1_EE3endEv pcap_dump_fopen _ZNSt14_List_iteratorIP9request_sEC1Ev maximize_fdlimit _ZNSt6vectorI9probespecSaIS0_EE9push_backERKS0_ finish_parse _ZN9__gnu_cxx13new_allocatorIP9request_sEC2Ev _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEE10deallocateEPS4_j _ZNSaIP12ServiceProbeED2Ev _ZN6Target6ifTypeEv time _ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _ZN9__gnu_cxx13new_allocatorIP6TargetE10deallocateEPS2_j getmsg strlen _ZN13HostScanStats23destroyOutstandingProbeESt14_List_iteratorIP10UltraProbeE pcap_minor_version _Z12block_socketi _ZNK9__gnu_cxx17__normal_iteratorIPKhSt6vectorIhSaIhEEE4baseEv _ZSt4fillIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEhEvT_S7_RKT0_ nsock_readlines _ZNSaIP12ServiceProbeEC1Ev _ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEC1Ev sappend _ZN9__gnu_cxx13new_allocatorIP12ServiceProbeE8allocateEjPKv _ZNSt10_List_baseIP13HostScanStatsSaIS1_EEC2ERKS2_ _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEED2Ev _ZSt10__distanceISt20_List_const_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag _ZSt20uninitialized_fill_nIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEjhET_S7_T0_RKT1_ _ZN6TargetD2Ev pcap_set_debug _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEE8allocateEjPKv _ZN9__gnu_cxx13new_allocatorIP13HostScanStatsEC2Ev _ZNSaIhEC2ERKS_ _Z18enforce_scan_delayP7timeval _ZNSt4listIP13HostScanStatsSaIS1_EE5beginEv _ZNSaItEC2ERKS_ system _Z17write_host_statusP6Targeti _ZNKSt14_List_iteratorIP11host_elem_sEdeEv _Z14build_icmp_rawPK7in_addrS1_ittthhPctPj _ZNSt4listIP9request_sSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ _ZN6TargetC1Ev _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEEC2Ev _ZN4PortC2Ev _ZN17ScanProgressMeter12mayBePrintedEPK7timeval _ZN9__gnu_cxx13new_allocatorIhE10deallocateEPhj pcap_ether_hostton _ZNSt15_List_node_base4hookEPS_ fwrite inet_ntop_ez _Z13ipid_sequenceiPti _ZN6Target10InitializeEv _ZN7NmapOps18setMaxTCPScanDelayEj _ZNSt14_List_iteratorIP12dns_server_sEC1EPSt15_List_node_base _ZNKSt6vectorItSaItEE5beginEv SSL_CTX_set_cipher_list _ZNK9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEdeEv .urem _ZN8PortList15port_list_countE _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEE8allocateEjPKv _ZN7IPProbeC1Ev __gxx_personality_v0 printf nsi_get0_ssl_session _ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EED2Ev _Z12lamont_hdumpPcj _Z12printmacinfoP6Target _ZNSt10_List_baseIP12dns_server_sSaIS1_EEC2ERKS2_ _ZN17ServiceProbeMatch7getNameEv _ZNSt12_Vector_baseItSaItEE12_Vector_implD1Ev _Z8shortfryPti _Z25servicescan_write_handlerPvS_S_ MacTable strtoul _ZSt10__copy_ni1IPhS0_ET0_T_S2_S1_12__false_type _ZN10UltraProbe5pspecEv _ZNSaISt10_List_nodeIP13HostScanStatsEEC2ERKS3_ _ZNSt6vectorIPKcSaIS1_EEC1ERKS2_ _ZNSaIP6TargetEC2ERKS1_ _ZN8PortList12setPortEntryEthP4Port _ZNSt12_Vector_baseIhSaIhEE13_M_deallocateEPhj pcap_dump_close _ZNSsD1Ev _ZNKSt4listIP13HostScanStatsSaIS1_EE5emptyEv _Z14MACPrefix2CorpPKh _ZSt8_DestroyIPPKcEvT_S3_ _ZNSaIP17ServiceProbeMatchED2Ev _Z40output_ports_to_machine_parseable_outputP10scan_listsiii pcap_getnonblock_fd pcap_get_out calloc _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES3_ET0_T_S9_S8_ _ZSt38__copy_backward_output_normal_iteratorIPP12ServiceProbeN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type _Z10max_rcvbufi _ZNSaISt10_List_nodeIP10ServiceNFOEEC1IS1_EERKSaIT_E feof inet_ntoa ip6_pton _ZNSt4listIP9request_sSaIS1_EE9pop_frontEv nse_status gen_pf_srnr _ZN13HostScanStatsC2EP6TargetP13UltraScanInfo _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ _Z13getinterfacesPi _ZNKSt6vectorIhSaIhEE5beginEv _Z9idle_scanP6TargetPtiPc _ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEplERKi _ZN7NmapOps21setMaxRetransmissionsEi _ZN12ServiceGroupC1ERSt6vectorIP6TargetSaIS2_EEP9AllProbes _ZN7NmapOps12getStartTimeEv _ZNSt6vectorIP6TargetSaIS1_EE8pop_backEv _ZNSt12_Vector_baseItSaItEEC2ERKS0_ _ZN13HostScanStats22num_probes_outstandingEv _Z16printfinaloutputv _ZSt14__copy_trivialIPKcEPT_PKS2_S5_S3_ _ZNSt4listIP13HostScanStatsSaIS1_EED1Ev _ZNSaI9probespecEC1Ev inet_ntop _Z9arg_parsePKcPPPc realloc get_random_u8 arp_close pcap_major_version gettimeofday _ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type _Z6sigdiei _ZNSt4listIP13HostScanStatsSaIS1_EE9push_backERKS1_ _ZN9__gnu_cxxmiIPKP6TargetS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE vfprintf _ZNSt4listIP10ServiceNFOSaIS1_EE5frontEv _init gen_greater _ZN10ServiceNFO14addServiceCharEci gen_byteop _ZNSt4listIP12dns_server_sSaIS1_EEC1ERKS2_ _ZN13UltraScanInfo18numIncompleteHostsEv _ZNSaIP12dns_server_sEC1Ev _ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_11__true_type longjmp _ZSt18uninitialized_copyIP9probespecS1_ET0_T_S3_S2_ gen_proto_abbrev _ZSt10_ConstructI9probespecS0_EvPT_RKT0_ _ZN10UltraProbe5setIPEPhjPK9probespec pcap_set_out _ZNSt10_List_baseIP11host_elem_sSaIS1_EEC2ERKS2_ atoi _ZN7NmapOps14maxHostGroupSzEv _ZN13HostScanStatsC1EP6TargetP13UltraScanInfo pcre_study gen_mcode _ZNSt24__copy_backward_dispatchIPtS0_11__true_typeE4copyEPKtS4_S0_ _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_ _ZNSt12_Vector_baseIP6TargetSaIS1_EE12_Vector_implD1Ev nsock_connect_udp _ZNSaISt10_List_nodeIP9request_sEED1Ev _ZNK9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEdeEv SSL_library_init strrchr pcap_sendpacket msevent_cancel _Z14unblock_socketi _ZSt10__distanceISt20_List_const_iteratorIP12dns_server_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag nsp_next_id _ZSt4copyIPP6TargetS2_ET0_T_S4_S3_ _ZNSaISt10_List_nodeIP12dns_server_sEEC2ERKS3_ pcap__create_buffer _ZN13HostScanStatsD2Ev _ZN12ServiceProbe13setPortVectorEPSt6vectorItSaItEEPKci _ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEE10deallocateEPS4_j nsp_new _ZN15ConnectScanInfo7watchSDEi _Z32parse_fingerprint_reference_filev _ZNSt6vectorItSaItEEC1ERKS0_ _ZN9__gnu_cxxeqIPKP6TargetSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESD_ gen_or _Z11bounce_scanP6TargetPtiP7ftpinfo _ZNKSt6vectorIP6TargetSaIS1_EE5beginEv _ZNKSt20_List_const_iteratorIP12dns_server_sEneERKS2_ _ZN8PortListC1Ev _ZSt20uninitialized_fill_nIPhjhET_S1_T0_RKT1_ _ZN7NmapOps17setMinHostGroupSzEj _ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE5beginEv _ZNSaI9probespecEC2ERKS0_ _ZN4PortD1Ev _ZN10UltraProbe6isPingEv librt.so.1 SUNW_1.2 libsocket.so.1 SUNW_1.4 libnsl.so.1 SUNW_1.7 SUNWprivate_1.1 libm.so.1 SUNW_1.1 libgcc_s.so.1 GCC_3.0 libc.so.1 SUNW_1.19 libpcre.so.0 libssl.so.0.9.8 libcrypto.so.0.9.8 librt.so.1 libsocket.so.1 libnsl.so.1 libstdc++.so.6 libm.so.1 libgcc_s.so.1 libc.so.1 /usr/local/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/local/ssl/lib:/usr/openwin/lib:/usr/lib            
='                     
='                    0
='         Nq              *       
='      4        =       y&P      K        S       y      ]            d                        G            /                    p     (      4 d     @      L      X      d H     p      |             j      2            `                  C      Q      ,                   h     $ .     0      <      H 3     T      `      l       x       &                                ^      -                         x      v             2     ,      8 Y     D      P      \      h      t  E      5                                                             6                         (  y     4      @       L      X  %     d      p      | &      :      $                                      Q      }      z        q      a      w     $ B     0      < {     H 4     T      `      l p     x D                                                 G       F      0                  l            ,      8      D 6     P      \  .     h       t       M            t      ,      =       k                        a                             (      4      @ :     L J     X '     d  f     p ,     |       c                                                                                 $      0       < a     H      T      `      l  >     x ^      #      i                                                 R      2            x       W     ,      8      D 1     P 4     \ -     h      t A                   *              _      '                   ;            
      @D#    @    #P@|   @     , @
 !" @  Z   @q   @r   㿐#   / 8`@        ` @ @ ` "        `@ $     @ `  `   ``     `@N` +    㿐  㿐   / ͮ`        `  @8   `     `  `$`     @-       㿐  ?b 'D'H'L aܚH    @    *'D','(?b @?b| @?b @   @
   ?b?b @ @ @@      @      В``@      В``@      В``@      ϒc@   H @  /@    '<<`     H @ '<    < `'< b@    '$$`  2   8 (  b$@    g     b@ r<   8,  @ v    '44`      b@ q   4,@     ' ,@ x    ?bh@#@    '@@D@    @(`@< X@    `      c <@   ?b  @    @ `'@   ?b @`     D`     H@ c8@ @}    `     ?b  @?b @`  >   D` /    H@ cH@ @a    `  #    H@4, @   @      
    H@ cX@ @ q~   4,@ h    ?bh@#@ <   DH@ ]    ?bh@#@ 1    c c c c@$    c@     `@    !b@   8 (  !b@    `      !b@    `      ` @ q;   8,  @ v    '44`      `8@      , @  `h@    `     , @  `p@    `     @ "      , @  `x@    `  4   , @  `@    `  *   , @  `@    `      , @  `@    `     , @  `@    `     , @  `@    `  	    `@     @j   , @  `@    `     , @  `@    `      c@3&    c #`X4,@    p   , @ @ (`8``!    8  !@t    '$$ ` @p   Z   , @ @ (`8``d     c c ` `#`I   , @  `@B    ` 7   @T   '  ?bd @ @ ?bd @ @    ?bd@@ `        ?c(?c((@(@  `@3    '4@    (`,@ @  `@    `      ` '4 @     `@ p4   ?c( @(`,@  @ $ @    a   (`,@ @  a@ r\    `      ` '4 @     `@ p   ?c( @(`,@  @ $ @    8   ?b| @     @(`,@ @ @     ?b| @  `c      a@   (`,@?b| @     @        a @ o    `'p    c ``      a8 @ o    @         aX@ p   ?c(@(`8``     H?b @   @        ?b @ `  <@  @    ?c( @H @ $ @_       ?c((@ a@1    ?c$ @ @`  }   ?c  @?c$  @  @   ?c$?c  @ @?c$ @`  b   ?c$ @@ (`8``  X   ?c$ @ :@     ?b @?b @`     ?b @(@ ?c( @?c$ $  a @<@   ?c( @?b @  @            ?c((@?b @`     ?c$?b @ ` @   ?c$ @   ?c(@(`8``      a@ n      @      @      @      @   ?c(@(`8``     ?c( @(  @ s    '00`      a@ n        '0 @    '((?c( @#   (@ @  c ``     ?c( @ a @ n    c ``  !    b  @    ?b @?b @    ?b @ @o   ?b @ @h   ?c( @ !` ( @ @`    '   "   ?c( @ b @ n        b(@ n        b8 @    
   , bH@ @      ,@ ta      ?bh @ @   㿀'D''D@ (`8` @'    `     D   @    '@ (`8``     쀠`     쀠`     p   ?' n   D b@    `     `'D b@    `     `'D b@    `     D b@    `         `'D b@    `     D b@    `         `'D b@    `     `'D b@    `     ` 'D b@    `     `''  㿀'D'HH'H @@    '耠`  \      +@  `#   :@    '䀠`        +@  `#  D a@ ! @N   D@n    4"H 	   D a@ ! @?    :@    '䀠`        +@  `#  D ?@*   D `@  @#    8   D `@$  b @    D ?@    (   H :@Z    '䀠`        +@  `#  D a@ H! @   D@    4"H 	   D a@ H! @   DDD(b@+a?+ ?    㿐'D'H c  `x ` `@   H@      㿀'DD'@ / @@ / @@ / @@ /`'`% -   `$ S   `    ` K   ` ` J    D   ` @   `    `
 8    :   ` 2   ` .    0   `2    `1 $   `'     `*        `    `    `7        `    `         '    ``L    ``O     '    ``[    ``{     '    ``    ``    ``     '    ``    ``     '    `` '   ``     ' {   ``     ``     ' m   ``X    ``c     ' _   ``    ``    ``     ``@     ' G   ``    ``     ' 9   ``    ``    ``@ 	   ``A         '    ``     '    ``    ``    ``     '    '  x'D'H'L c ```     @^   '     `        ' @     c $ @/    i   D`      ` @ H@     `  (`L `"  @ '    '' Z   'D@v    '耠 =   耠`     耠`    耠`
 
   耠`	    耠`     쀠`         c@(@  c' ,   쀠c     c   @+  `"     `$ @ k,       c@(@  c@ (`8``     '     c'܁   0'D'H''''7 77'''''''''' `0"P   @   ', @>     @X       ?c( @ @ ?(  @:   ?#( #  ?c(@@ @    @,   ''' cH@ /!     @   '/_?'X?'T?'P?'L?'H?'D?'@?'<  adH%   @P   D(` ` @   '('D@    (`H@ @ @     (`(@ @  `'   D(`(@ @ D`    H @ ?y     d@&    ` #@ H`D( cX @k    '   `v   (`  ǂc@@    `(`@ sX `@ l    `      b8 @ @ p    '܀`     c@ j8   ܀`     c@ ja   'D   `(`@ sX `@ lb    `      b8 @ @ pk    '܀`      `8@ j     0cP@     `h@ j7   'H   `(`@ sX a @ l8    `      b8 @ @ pA    '܀`      `@ i   'Lu   `(`@  sXa8@    `      b8 @  a@    'Ȁ` [    b8 a@ @ i   R   `(`@  sXaH@~    `     Ȁ`      a@@ i    b8 @ @    '4   `(`@ sX a`@ k    `      b8 @ @     c @1      `(`@ sX a@ k    `      b8 @ @y     c @1    b8 @ @n    `d    a@ i      `(`@  sXa@    `      c?$"  b8 @    ?c$@@ #` c `Ԁ`     a@ i8      `(`@  sX`x@
    `      /_   `(`@ sX `@ k\    `       c b8 @ @   $  c ``      b @ i    c ``d    bX@ i.      `(`@ sX a@ k1    `  "    b8 @ @ o:    '܀e     b@ h   '<  b@j    c cH`@ i   a   `(`@   sX`@
    `      c b8 @ @
   $#h c ch`  
    c ch`    >    c@ h   8   `(`@  sX``@
d    `      c? "  b8 @ @
    ?c @@ #cp   `(`@ sX  `0@ j    `      c #cP   `(`@   sX`@@
1    `      c +c   `(`@ sX  ``@ j    `      b8 @ '   `(`@   sX`@
    `      c #`   `(`@ sX  `@ jo    `      c b8 @ @
)   $  c `䀠`  
    c `䀠`	        `@ h      `(`@ sX  `@ jF    `      c #`   `(`@ sX  `@ j3    `      c 	#`}   `(`@ sX b @ j     `      b8 @ @ n)    '܀`      `8@ g   'T]   `(`@ sX a@ j     `      c #`J   `(`@ sX b @ i    `      b8 @ @ m    '܀`      ``@ g   'P*   `(`@ sX b@@ i    `      b8 @ @	    'DD`     `@ gz      `(`@ sX b@ i    `     `(`@  sXc@	+    `      c #` c  #`\   `(`@ sX b@ i    `      c #b   `(`@ sX c@ ix    `     `(`@  sXc @    `      c #b   `(`@ sX c8@ iX    `  	    c @5      `(`@ sX cX@ iD    `      c @    c c ` `#`   `(`@ sX cx@ i)    `  6    c b8 @ @   $  c `Ā`      `@ f   e    c `Ā` _    c?"  c `@4   ?c@@ #` c c` `@{   E   `(`@ sX c@ h    `      c #`2   `(`@ sX c@ h    `      c #`   `(`@  sXc@K    `      b8 c@ @.   	   `(`@ sX c@ h    `  	    c  @.      `(`@ sX  a@ h    `      c(ct   `(`@ sX  aX@ h    `      c?"  b8 @ @K    ?c@@ #c|   `(`@ sX  a8@ hf    `      c +c   `(`@  sXc@    `  
    c `@.j      `(`@  sXbX@    `      b8 @ '   `(`@  sXbh@    `     `(`@  sXb`@    `      b8 @ 'h   `(`@  sXbp@    `      b8 @ 'U   `(`@  sXbx@    `      a@ e   B   `(`@  sXb@n    `      b8 @ '/   `(`@  sXbP@[    `  F   ?cP @ b8 $  a  @A   ?cP @ @    '?cP @ b8 $  a  @+   ?cP @ @x    '?cP @ b8 $  a  @   ?cP @ @b    '   `(`@   sX`p@
    `  	    a@     @   `(`@   sX`x@    `      c #cl   `(`@  sXb@    `  0   ̀`      a@ e    b8  @ b@    `      !b'    b8 @  a@    '̀`     b8 b@ @ d   |   `(`@  sXb@    `      c #`` c b8 @   
@   $ @ (`8`` Y    b@@ d   S   `(`@  sXb@    `      c #c$ b8 @ '<   `(`@  sXc@h    `      c c ` `#`&   `(`@   sX` @R    `      c c c `#c   `(`@   sX`@<    `      c #@    `(`@   sX`@)    `      c b8 @ @Z   $# c c`      c c``         b@ dA      `(`@ bsX@ d6       c @<       c #b c @ `     c c b `#b    c c c `#c0 b8  @ u    `     !b c @       b8 @ ' ,@&    '耠`     (@  c@    `      c b     c@ c    c c b@   `#@ " *    c b`~     cȒ @ c    c b(` ` @ @ G    `      c c b `#b     `@ c   耠`      ,+@  `'耠` /       b8 @ `      c c b8 @ @   $  $`    c c ` `#` c c ` `#`	    b8 c0@  ?@N    c(`W    `7    c c c `#c    c b8 @ @X    4 h c 3`j c`h(`0``     ``@ cs      H @   <      H @ ?5       `@      ̀`      a@ c#    b8  @ b@    `      !b'    b8 @  a@#    '̀`     b8 b@ @ b       b8 @ @    'XX`      `@ b   Xc~    a@ c   x    b8 @ 'r    c c cH `#cHi    c c b `#b`    b8 @ 'Z    b8 @ @ (`8``      b8 @ @ (`8``I     b8 @ @ (`8``E         c c c `#c 4    b8 @ @ (`8``M     c c c `#c "    b8 @ @ (`8``P     c c c `#c     b8 @ @ (`8``0     b8 @ @ (`8``N     b8 @ @ (`8``D         c #c     b8 @ @ (`8``R     c c c d #c     b8 @ @ (`8``S M    c c c `P#c   b8 @ @@ (`8` @+    `  '    c?"  b8 @  `   c      ?c@ d   ?c@@ #`l c `l`      ah @ b    c `l`     c #`l c P3`p    b8 @ @ (`8``T     b8 @ @ (`8``A     M    c c c `0#c   b8 @ @@ (`8` @    `  '    c?"  b8 @  `   c      ?c@ dV   ?c@@ #` c ``      a @ a    c `` 2    c #` c P3`(    b8 @ @ (`8``U N    c c c b #c   b8 @ @@ (`8` @x    `  '    c?"  b8 @  `   c      ?c@ d   ?c@@ #` c ``      a @ aP    c ``     c #` c  bj3`    b8 @ @ (`8``B J    c 2#c   b8 @ @@ (`8` @&    `  '    c?"  b8 @  `   c      ?c@ c   ?c@@ #` c ``      a @ `    c ``     c #` c P3`    b8 @ @ (`8``O     a@ `   s    b @ `   m   `     `          b@ `    b8 @ @    'V    `7Q    c c cx `#cxH   7E    c ``      b@ `    c@     b8hd @   @ B    `  #    c@{    ` 
    cP?"      cX?c@#@  b8 c`?#   @ @ `t   h c d@#+    c #`    b8 @ @ (`8``      !b c@u   H @ ?U    b8 @ '@ (`8``    @  ?c @#@ ?#   ` p   ?c@@ (`  ǂb@@     c #c n    `h@ `&    h    c #c  b    c #c c #c  X    c #c, R    c #c0 L    c #c( F    c #c @    c #c4 :    c #c8 4    c #c@ .    c #c (    c #b "    c c c< `#c<     c c cD `#cD    @ (`8` ` @ _   H @ ?    `'l    b8 @ @ (`8``0     b8 @  `@l    `      c ` c #` c $c#` c $c@'   %    b8 @ @ (`8``1     b8 @  `@D    `      c #` c #` c  b#` c  b@'i       b8 @ @ (`8``2     b8 @  `@    `      c #` c #` c!#`    b8 @ @ (`8``3    b8 @  `@     `         b8 @ @ (`8``4     b8 @  `@     `  !    c #` c d@&    c$@&    c!@'    c 
@    c @'        b8 @ @ (`8``5     b8 @  `@     `  &    c #` c 2@&    c!,@&    c @&    c nc#` c @    c @&   Y    a @ ^   S    a `x ` `@ {     @ N    c c ` `#`=   @f    c ``        В``@ S   X     cX#`T .    cT#` c c@Z     Ѐ@ 	    c c`@\    c c@:     Ѐ@ 	    c c`@&    c #`P     cP@=    cP@   L     cL@&L   H     cH@&!   D     cD@%   @     c@@&S   <     c<#` c b`      c?" @    ?b@@ #`d c@"   `  	    c  cP@ d   `  	    c  cP@ Y   `  	    c  cP@ N   `  	    c  cP@ C    c `X`  d     @    ?cL @?cL @ @    'DD`      a@ ]   ?cP @   aD@    `      a@ ]   ?cP @$ b `x ` `@     c ``     D ``    D ``    D ` D ` `$ b8  @    _``     @      @    c c`  
    c c`         (`8``      bp@ ]g   `     @     '`      b@ ]V   @|   '(`8``     `      b@ ]D    3   (`8``      c c(`     @
    ' !   (`8``      c@!h    `?"  c@!    `?b@@  @    ' c c`  
    c c`      
   `      c0@ \   쀠`    ?cL @ c@    `     ?cL @    'DD@ (`8``  c   D@ (`8``:    D `'DD@ (`8` @    `  N    D@@ (`8` @    `  A   ?cL @`     c@ \   ?cPD@ (@?cP @ D@@ + ?cP @(`?cL @ @?cP @    @    ,<?cL?cL @ ` @D `'D   D@ (`8``      @d    ``      c@ \d   ?cL  @?cL @`    ?cL @ ?cL  @#   @    @c    'D`?" 	`?b@#@ 
`?" #  `?" `#\`#`D?b@#@ D`      `?" ?b@@ #d$ `?b @ @ ?"   ?b@@ ?b @ @ @ k    c @$u    c ``     c #``  '    c c(`     @    '     c@     `?"  c@ H    `?b@@  @K    ' c@      ``      ``      `@ [    c@ '    ``      ``      aP@ [    c c(`      ``      a@ [    c b S    c?ܖ"  c b`     @)   ?bؚ@#@  c?ؖ  b@    ?"ؘ #      ?bؚ@#@ ?b؂ @ @ ?b܂ @ @  b c c b `#b c b ' c b䀣@    (` ` (` c@#  '    c@    ` $    c@'    `      c0@ (`8``      c@     c0 @ N    `      b @ [    c@    ` >    c0@ (`8``  6    c@    `  .   ?cX @    @   ?cX @ ` c0 @ N         c( c0@ Z   ?cX 0@?cX @ c  @    c c`  M   0 a@0 bD   @    `  $   0 a@ @    ',,`     0 bD, `  @  @N    *   0 a@ !b c @    @1    c ``     t?cL @?cL @ @    0 a@$  c  @     !b@A    !b@=     @    ' @    h   @|   h @ \n    c@    ?cL @?cL @`     ?cL @@     'D?cH @ $  cD@   D@`       ?cH(@?cH @  ` @      `8@    h  `@ `x ` @    'D@ #   (`(@ @ @ i    'D  ``D@ r   D@(   (`(@  ``@ @ e    `'     `h@ [     `p@ V     `x@ Q   'D@ '   D 䀣@ 
    `?"Ԙ #       ``?Ԗ" (`(@ ?bԚ@@  @ @ +    `'   h  `  `@    @ n    c c  ` `@     c ``      c@    ` c c c< c(@    (`8``  P   H @ @b    'Ѐ`     a @ Yt   H @  a @N    'Ѐ@    H @ Ԃ@(@ Ԃ `'    'D@ #   (`H@ @ @2    ''Ѐ@    (`H@ @ Ԃ@(@ Ԃ `'    `'     @    c ``     @ V    '䀠`      c `䀣@     c !b a`@.    c `` 
    c$  b8`@ s    c ``  W    bh@    c@     c@     b  @    c@d     c@Q     c@>     b   @    c@     c@     b  @    c c c` @    c@
     c c(  @r    cP@n    c c(`  	      ``@    c@    ``  	     @ `@    c@    ``  	     ``@   (`8``  )    ``      @ `@ \    @ `@#    ``      ``@ \q    ``      ``@ \f    c `\(` @z   'Ȁ`     `         @ '    ' c ``    @ (b   Ȁ`     @a   `     @H    c `\@ ,   D(c    'Ā`  !   @       (`  @ `"  c ``     c c c@ @   `      c@ W   $\@!   ?bЂ @ @  c c?Ж `\ `@&       ?#( #  ?c(@@ ?bЂ @ @ @   ?("    ?"И   ' c c@ ʼ   ' @    @     c #c b@ .2    '$$`     '@    (`@ @ @    `'   ' c `\@ 0    c ``      c c c@ @        D(    'Ā`     @n       (`  @ `"    `        ?b̚@#@ ?̖      ?"̘   @&   ?b̚@@ @p   $\@j   ?bȂ @ @  c c?Ȗ `\ `@&8       ?#( #  ?c(@@ ?bȂ @ @ @K   ?("    ?"Ș   ' b@ -    '$$`     j    c c c `#c$ ````      c c`  	    c c c `#c c c`  
    c c`      1     c@ 2    c$ cx@    $@      c@ $   @    $?bĚ@#@ ?Ė     ?"Ę   @&   ?bĚ@@ @       c ``     hd c  @   h$ d@'   $ `````     $?b @ @ ?"        ?b@@ @&   ?b @ @ @       c@H    `     c@    ``     $    @'    `  S   hd c  @    `  
   h$ d@'    ?    ! @s    `      c@    hd   @ 8K    `      c@ V   h c d@   h$ d@'   `     h @ 7     !b ` @    '$@    `      `@ U    @0    `  2    @(       @     @  @    $@      @    `     @     c c c #c c c c #c .    c b(`?⼖"  ` ?b@#@ ?cD @#@$@'<      ?cD @?"   ?b@@ # $  @       @    `         c?" #   @   ?b @ @  c c@U    ` 6    c@    ``  -    c b(`?Ⱆ"  ` ?b@#@    @     @ ?c@ @#@ @&      ?c@ @?"   ?b@@ #  c c8`       @ 3    c c`       @ '    c c@`       	@     c c `       @     c cD`       @     c c0`       @     c c,`       @     c c<`       @     c c`       @     c c(`       @    '؂ @    ؀@ D    @T     @ '$ c c$`      c #c@]O   $ @ `@ m&    c c`      c #c@];   |`     0 @ G   |`     0$ @ ` @    ؂ `'    c b`      c #c@]    @V   '؂ @    ؀@     @     @ '$ c b`  
    c c4`         $     
@ u    c b`     $@ e     c@     c$ cx@ H   $  @'y    ``      $ !@&+    $ `Д @    $@    $@m      `  @ p       $ ``$ @    $@ T   $@    $@     c ``     $$$$  a` @ N   $ `p@ I     c@ D   ؂ `'s   @     @    ``  '    @8     @ '$$?" #  ?b @ @ `     ?⨖ @#   ?"   @    @4       c c c ``     c c` c@   ?b@#@ ?⤖      ?"   @"   ?b@@ @   `  	   `     @   ''@    (`@ @ @    `'   '@|   @ z   `      @ @r    `@n    `@j   @g   @ 7   'D@    (`(@ @ @X    `'   (@P    @   ?c, @ @     ?(" ?#(    @   ?c(@#@ ?c( @ @ @   ?,         $      < d |       < $  ` d                                                                     ڴ           ` ߜ                  L  P  ( L ݸ     $ < ߄ P      x'D'H'LD  @ Z    '쀠`      aXD@ R]   耠`     axD@ RT   @( a@    '`      `'     aD@ R;   @ (`8``     @ (`8` @w    `      `'   @ (`8``      bD@ R    `'@ (`8``
 	   @ (`8``      bD@ R    
@,    '܀`  
    @c         b8D@ Q     b@   #@ `c     b@ Q    `#@  @{   #@ @(|  b@    `      c@ Q    L@ V    H @ H @      bD@ Q   '' c@    '܀`     ܂ `''   ؀`  '   ؒ  @    '܀`      bD@ Q   (@  ؔ @    `      bD@ Qr   ܂  +@     '' c@    '܀`  
    @  ` @ '   ؀`     '܀`  .    c@    '܀`  #   ܂ `'@ (`8` @7    `     ܂ `'    ܒcؔ @v    `    '   ؀`  :   ؒ (@G    '؀`      bD@ Q   ؂ `'ؒ )@5    '܀`      bD@ P   (@  ؔ @&    `      cD@ P   ܂ )+@      	`(@ Q   ' c#@ @ 
+@#        x'D ''D  ?c   @    `     @r     !b 	` @    	`@    c ``  4    a @ `  .    c  @&   D @    '䀠`      @ 2    @r     !b 	`  @    	a8@    a #@   `'D'?b'?n`y''''' c@    ``     `' c@    ``     `' c c(`     `'  @@r   'D'@ (`8` @    `     ܂ `'   @ (`8``T    ܂ `'@ (`8``: 	   ܂ `'܂ 'Q   @ (`8``U    ܂ `'@ (`8``: 	   ܂ `'܂ ':   @ (`8``P    ܂ `'@ (`8``: 	   ܂ `'܂ '#   @ (`8``-     ' ;   @ (`8` @    `  ,   ܒ  
@    '䀠`  
     ?c@         	a@@ O   '@ (`8` @    `     ܂ `'    	a@ O   @ (`8``     @ (`8``,        ' R   @ (`8``- G   ܂ `'@ (`8``     @ (`8``,          ?c' 3   @ (`8` @m    `     ܒ  
@f    '`  
     ?c@         	a@@ OR   '     	a@ OJ        	b`@ OD   @ J   @@ `@`     耠`  7    	b@ O_    `' .   ```     Ђ `'0````     ̂ `'0````  	   䀠`    Ȃ `'@@@   *  `'   @ (`8` @:    `     ܂ `'   @ (`8``     @ (`8``,     	cH@ N   @ (`8``,    ܂ `'܀`     @ (`8``        ̚@Ȃ@`      	c@ N    @q[   'Ѐ`  	   Ђ @ @qP   $  ̀`  	   ̂ @ @qE   $ Ȁ`  	   Ȃ @ @q:   $ #`#`#`''''  ?c@ L   Ԃ@@ ````     Ĕ   @  3  `" Ԃ@@ `0````     Ĕ   @ 3  `" Ԃ@@ `0````     Ԁ`    Ĕ   @ 3  `" Ԃ `'   @V   İ   㿐 
`@        㿐'DD `@  Q    D `D@      D c"  
cp  D@    c   㿈'DD`	 /   D`O &   Dk    D;  c@    D;  ab@     
c'     
c'     
c'     
c' 
    ` '     `'   㿈'DD`  ,   D(`  ͂`\@@     `' #    `8'     `H'     ``'     `x'     `' 
    `'     `'   40 3 3 4D 4 4D 4D 4D 4 4D 4D 4D 4D 4D 4D 4D 3 4D 4D 4D 4D 4D 4D 4D 4D 4D 4D 4D 4D 4D 4D 4D 3㿈'DD` ,   D(`  ͂a@@     `' #    `'     `'     a'     a('     aH' 
    aX'     `'   5 5( 5< 5d 5P 5 5x㿈'DD` '   D(`  ͂b@@     ax'     a'     a'     a'     a' 
    `'     `'   6l 6 6 60 6D 6X㿈'DD` h   D(`  ΂`@@     a' e    a' `    a' [    a' V    b' Q    b ' L    b0' G    b@' B    bP' =    b`' 8    bp' 3    b' .    b' )    b' $    b'     b'     b'     b'     b'     b c' c@      6 6 7 7  74 7H 7\ 7p 7 7 7 7 7 7 7 8 8$ 88 8L㿈'DD` '   D(`  ΂a@@     c '     c('     c8'     cH'     cP' 
    c`'     cp'   9 9L 9 9$ 9 9 98 9` 9th'D c ``  
    c ``         D `@D a@DbH(`0`$  cxD   @       @r    '쀠`  	    c@b   'I    7D bD'DbH7ڂ  @Z    'Ԁ`      !b c@    @    c ``  
    c ``         $  ` @ I    '   @ I&    'Ԁ`      c ``  
    c ``        Ԃ @(wА$  ` @ "      Ԁ`  	    `@    @A   А ! `@D@]   А @}         @    '   @ H    'Ԁ`  	    `@    @   Ԃ @(w c ``  	   А$  `P @    Ѓ(`8``5     !b `pD@z    @   D `@ ! ` @   А @0         @    '   @ H    'Ԁ`  	    `@    @   Ԁ`  
    !b `@A    &   Ԃ @(w c ``  	   А$  a  @    Ѓ(`8``5    D `@ !b a D @    @    '   @ HK    'Ԁ`      c ``    Ԃ @(wА$  ` @ O      Ԁ`  	    `@+    @n    c ``     $  aX@ 7   D bL'́  㿀'D @    '耠     a@ K_       쀠`      a'     a' !b a@        㿈'D' !b@Z   D` 5   D(`  Ђa@@     !b a@    /    !b b @    '    !b b(@        !b bP@    '     !b bx@x    '     !b bD@m    ' !b@    @    쀠`     @    @       AX @ @ AX AX AX AX AX AX AX A0 A AX AX AX @ȝ 'DhD @        'd    |0`````     |0````      'd    'dd  x'D'H'L' c cp`       cDH bcpL@    '耠`     H@    D    `      '䀠`  (    b@    '쀠`     DH bL@    '耠`     H@    D    `      '䀠`  a   @     @    '`     DH b`L@\    '耠`     H@    Dc    `      '䀠`  4   @    @      +   @     @    '`     DH b`L@&    '耠`     H@    D-    `      '䀠`     DH b bL@    '耠`     H@    D    `      '䀠`  4   D@ (`8``. -    "  bL@    '耠`     H@         `      a@   `#@    	    c  D@ I-   䀠`     DH bL@    '耠`     H@    D    `      '䀠`     D(@ ?'     c ``     cD@ H   '܁  㿈'DD'耠`    耠`    耠` 
       耠`         c'     c' 
    ` '     `'  H'D'H'L'P'T'XDH@ !    ' c ``  =   А   @,   H@   'H `   'L   'P`      ` '     `('#\\ @ #@ (`#@+` @(` @(`Ԛ@\ `#@#`$  `0T@    d `0쀣@     ` `  `@1   P`     ``  	   '`А   @   \`X@    l`    d `@    T@'' c `l䀣@    'd `耣@    d `@x    @'h(`(`@ @ '܀`  h   h a`      ` `  `@   hh a #a@T   h `(܀@    hh `( #`( ,h@ܙ0` (` ,h@ (`ܚ` (@8 @"	 h@ܙ0` (` h@ (`ܚ` (@8 @"	!,h@ܙ0` (`!,h@ (`ܚ` (@8 @"	h(`(`@?#@  `'{    `'n    H@X@ #  `# `# H ````     '   T`  L   d ``  G   d #` c ``  
   d$  `` `$@    d'd `  `$ a @  `Hd `(           d `  `$ a @  `H?    d `(? `  `$ c ``  
   d$  a ` `$@    L`    H `0````         L` >   H `0````  6   HH `#`HH ``#`d `,쀣@    d ``     d ``      ` `  a(@   d ``     dd ` #`dd @  `#@  e   L` ,   HH ``#`d ``      ` `  aX@   d `,쀣@ H   dd ` `#`dd ` #`dd ` `#` 7   L`     ` `  ax@   HH ``#`d ``      ` `  aX@}   d `,쀣@    dd @  `#@ dd ` #`dd ` `#`'́  㿈'D'H'(`D@ @ H@    '     `'쀠`         a@ FO   '  `'D'H'Lؐ @   ؂  @       '̂ؐ @   '@?   ؐ @    H@   'H@    ԛ(`D@ @  ` @    ԛ(`D@ @ ' c@    `c     c@   'ă(`Ă @(`Ă @(`'      ab' `ԛ(`D@ @ @    `  }   ԛ(`D@ @ @     @ (l    `  @  /ӂ``  5   ԛ(`D@ @ @    ԛ(`D@ @ @    $ a  @ .   ԛ(`D@ @ ԛ(`D@ @  `# ԛ(`D@ @ ԛ(`D@ @  ``#  >   ԛ(`D@ @ @    ԛ(`D@ @ @j    $ b  @    ԛ(`D@ @ ԛ(`D@ @  `# ԛ(`D@ @ ԛ(`D@ @  ``#     ԛ(`D@  @b   Ԃ `'<    @    ``      L @ ^    @       '̂ @   '@P        㿐'D'HD H@ H        㿐'DD ``      ` `!/ bX@   DD ` #`  h'D'H'L'''L`     '	   H`     ` `!C bp@   D'@ (`0``    ' (` @(` @(`L@ @    / (` @(` @(`L@ @    (`8``      (` @(` @(`L@ؐ   @    `      `'(`8`` .    (` @(` @(`L@ @       @?(@'Ԙ@ `Ԃ@      (` @(` @(`L@ @    '    (`8`` c    `쀣@     (` @(` @(`L@ @f    ' m   ` ``@     (` @(` @(`L@   @        ?c @ `  ?c @      (` @(` @(`L@  @   k    ?@ ` ?@ a    (` @(` @(`L@  @v   R   (`8``L    b@ D   F       (` @(` @(`L@ "  @   !   '́  ?a('D'H'L'P'T'X''?b$ ?c @?b  @?b  @?b0@?b ?c @?b @?b  @?a?0@p    @       @   d @    @`  $   d @   @`     d @   @`     \ ` А b@@$    '\ ` А b@@    '    '  b ' c`j(`0``     ?a c`h0@ 
   ?a c`h `0@ؐ   @)   ?b @X `` 	   ?b  @` 	   @L   ''H`  "   ?b,\?aЂ @H   @ 0U    @?b, @`  g   А   @    `   D0` (`@ (`@D` (@?@"D0` (`@ (`@D` (@? @" D `p      @    'Ȁ`     	$   ?b8 @D   `  @   '?b,?b8 @ @А   @   ̀`     ?b8 @А  ̖ @ #n   ?b ؘ#@ (`#@+` @(` @(`Ԛ@ܚ#@ @\ `  @ @?᠖"  b?a@@ @     b?᠖" ?b  @?a@@ @    ?b   @̀`     \?b ` @@    ?b   @̀`        ̀`     ̀` 	    c @ B      ?b @?b @?b, @`	``   ?b, @ @ 0```(`?b, @ '?b, @ @ 0```(` `̀@    ?b, @`(`8``     cX@ Bv      @ ``     @ `` 
   @ ``    	   ```    `(`0``@    ?aX``4# 0@?b$?a@(`0`X `@     @X?b$`0 @@     c ``    ?a@(`0`?b$X c  @0@ B   p    c ``  )    ?b, @  @ ?â @?â @ @    `(`0``(`0``(`0`$  c   @ (   ?b$ @(`L@?â @#@  @      ?â @?b, @ `  `?``  ^   ?b  @?b  @?b  @?b?a@(`0`X `@     @?b  @?b$ @(`L@ @ @"    `    ?a @    @n   ?a 0@?a @?b, @ `# ?b$ @(`L@?a @    @      ?b$ @(`L@ @ ?b$ @(`L@ @  ` `#    @ ``    @ ``    @ `` 
    c ``        ?b, @ @ 0```(` `̀@     c ``    @ ``` `(  @ A   u   ?b(?b, @ @ 0```(`?b, @  ` @?b, @ @ 0```?b( @ @ 0``` (` `̀@     c `` E   @ ``` `X  @ @   6   ?b( @`	``    d @    @`     d @   @`      c ``     `@ @      ?b( @ @ 0```(`?b( @ '`(`0``@ )    c ``    `(`0`@ ``` `ؒ `  @ @    c ``   ?b, @@ A      ?aX``4# 0@?b$?a@(`0`X `@     @?b?a@(`0`X `@     @X?b` @@ -   X?b$`0 @@
 $   ?b$ @(`L@?â @#@  @      ?â @?b( @ `  @  ``         c `` r    a@ @   l   ?b( @`	``    d @   @`      c `` V    ah@ ?   P   ?b4?b( @ @ 0```(`?b( @  @?b?b4 @`0@?b?b4 @@ (`0`?a@(`0`#  @X?b` @@     c ``    ?b a @@ ?   
   ?a?b4 @ ` @?a @`?` 1   ?a?a @0`X `4# 0@?b$?a@(`0`X `@     @?b?a@(`0`X `@     @ "    c ``     ?b, @  @ ?â @?â @ @/     a @ ?S      X?b` @@ -   X?b$`0 @@
 $   ?b$ @(`L@?â @#@  @      ?â @?b( @ `  @  ``          c `` p    a@ ?   j   ?b( @`	``    d @   @`      c `` T    a@ >   N   ?a?b( @X``4# 0@?b$?a@(`0`X `@$     @?b?a@(`0`X `@     @X?b` @@ -   X?b$`0 @@
 $   ?b$ @(`L@?â @#@  @      ?â @?b( @ `  @  ``          c ``     a@ >       c ``     b@ >      X?b$`0 @@     ` `"z bX@1   @ `` H   ?b  @?b  @?b  @```    d @   @`  	   ?b  @    c ``     ?b$ @(`L@ @ @٘    $  bx @ i   ?b  @?b  @   @ `` .    c ``     ?b$ @(`L@ @ @o    $  b @ @   ?b @?b  @?b  @?b  @p   @ ``     c ``     $  b@      0cP@,   Y    c `` S   @ ```$  bؔ  @    D   ?b, @`	``   d @   @`        ?b, @ @ 0```(` `̀@ 	    c @ =      ?b4?b, @ @ 0```(`?b, @  @?b4 @``0`````     ?b4 @````       ?b?b4 @@ 0@?a?b4 @ ` @?a @`?`    ?a @`?`    ?a?b4 @ ` @?a @`?`    ?a @`?`     1   ?a?a @0`X `4# 0@?b$?a@(`0`X `@`     @?b?a@(`0`X `@S     @    ?b$X `0 @?b$ @ /   ?b$ @(`L@?â @#@  @      ?â @?b, @ `  `?``         ?b$?b$ @  @   ?b$ @ "    c ``    ?b, @  @ ?â @?â @ @ހ     cH @ <      ?b?b4 @`(`0`?a@(`0`#  @?aX?b$` @@    ?b @ @0@X?b` @@     c ``    ?b a @@ <f      X?b$`0 @@     c ``     cx@ <Q      ?b$ @(`L@?â @#@  @'      ?â @?b, @ `  @  ``  "    c ``     ?b, @  @ ?a @?a @ @     c @ <   h    c ``  +    ?b, @  @ ?a @?a @ @    ?b4 @@ (`0`?b$?b$  cД   @ @@    ?b  @?b  @?b  @?b  @P0```` H   ?b4 @``0````  	   ?b  @5   ?b4 @````+   ?b  @$   ?b, @`	``
   d @   @`        ?b0?b, @ @ 0```(`?b, @  @?b?b0 @@ 0@?b?b0 @`(`0`?a@(`0`#  @X?b` @@     c ``    ?b a @@ ;K      ?b$X `0 @?b$ @ /   ?b$ @(`L@?a @#@  @      ?a @?b, @ `  `?``         ?b$?b$ @  @   ?b$ @ "    c ``[    ?b, @  @ ?a @?a @ @     cH @ :   A   ?aX?b$` @@     ?b @ @0@ c ``  +    ?b, @  @ ?a @?a @ @ܓ    ?b0 @@ (`0`?b$?b$  `    @ @@    ?b  @?b  @?b  @?b  @     c ``     ?b, @`	` ` @ :   ?b @`  T   ?b$ @(`L@?b?b?b?a@(`0`(`T@#\#`X#d#h?b @#lL   @ @ @\   ?b @` !   ?b, @`     ̀`    ?b$ @(`L@?aЂ @?b,   @  @ *   ?b@(`0`` v   t        H'D'H'L'P 'X7T'Ԃ'\T`4#@7TT(`0`\ `@I    'T(`0`\ `@<    'H ad@     ` `#/ `@ԩ   H ad@ O   '؀@ @   \ `@    @'HP(`(`@ @ `  '    c ``     $  `@    HP(`(`@ @ @   HP(`(`@?#@ HH a #a     `'   ؀@     a @ 9^   HP(`T(`0`(` @ @      ` `#B aX@@    c@.       @ۚ    HP(`T(`0`(` @ @ HP(`T(`0`(` @ @      a@ 9"   H'HP(`T(`0`(` @H `('@ '@    ' `(HH a `#aHP(`T(`0`(` @ @ @ %   HP(`T(`0`(` @ @    ؚL  @	~    `      a@ 8   @ (`0``     cP @ @`p3  
    cP @ @`p3 HP(`T(`0`(` @ @  @    '@Z    '쀠    耠`     .   T(`0`(`X@#\#`\#dH#h #lDL  `   HHP(`T(`0`(` @( @ @    HH `( #`(    耠` $    c ``      a@ 8   T(`0`(`X@#\#`\#dH#h #lDL  `    q    ,H@HP(`T(`0`(` @ @ 0` (` ,H@ (`HP(`T(`0`(` @ @ ` (@ @"	 H@HP(`T(`0`(` @ @ 0` (` H@ (`HP(`T(`0`(` @ @ ` (@ @"	!,H@HP(`T(`0`(` @ @ 0` (`!,H@ (`HP(`T(`0`(` @ @ ` (@ @"	     x'D'H'L 'T'X7P' c `l쀣@ %   쀠`      c `Ѐ`       @ ۦ   P(`0`X#\\#``#dDHL T    `'        p'D'H'L  'X7P7T' c`j(`0``      c`h7     c`h `7T(`0`\ `@     ' c c b(` @#@L@	      $ L@     c @(`0`P(`0`T(`0`#\ c `#` c `ă(`0`#dDH h  @ "7        X'D'H'L'P  7T7X' c`j(`0``      c`h7     c`h `7X(`0`` `@١    '@Z    (`X(`0`(`@ `'@Z    (`X(`0`(`@ `' c c b(` @#@L@      $ P0````  1   L@&     c @(`0`T(`0`#\#` #d#h b#l #p c `#t c `ă(`0`#xDH h  @     ,   L@     c @(`0`T(`0`#\#` #d#h#l#p c `#t c `ă(`0`#xDH h  @         X'D'H'L'P 'X7T'H`     L@
    Ȑ   @-   L@
    Ȃ `   @"   H'/؂'    'P0`	```  0   ' c `쀣@ (   쀠`      c `Ѐ`       @ 7    c @ @`(`0`T(`0`\#\DL X    `'   P0````  1   ' c `쀣@ )   쀠`      c `Ѐ`       @     c @ @`(`0`T(`0`X#\\#`DL      `'   P0````  1   ' c `l쀣@ )   쀠`      c `Ѐ`       @     c @ @`p(`0`T(`0`X#\\#`DL @    `'        8'D'H'L'P  7T7X `'%' '''L`     P@	       @U   P@	     `   @J   L'/Ђ'    'd0````      ' / 5   d0````      '   #@  `#    '  /    d0````      '   @w    `0'  '  /     b d@ 5W    c `Ā`  %    c ' `'@    ' @' c ' `'@    '  @?   /	X7T77
@ A   7
 c cl`     
 7
h@    @`  !       @    7#@P@      ' c c b(` @#@P@      $ ' c b@ [   h     @`  6    c b@ /   'D    @]    '@ 7   @V    '` /    !b bH@   @G     !b b @       P@    (` ` @ c#\(`0`#`H  h @ !P    `'        x'D'H'L'P  7T7Xd0````  $    c `Ѐ`       @ Z   T(`0`X(`0`\#\`#` #dh  '#hDHLP     d0````  $    c `Ѐ`       @ 1   T(`0`X(`0`\#\`#` #dh  '#hDHLP  l   d0````  $    c `Ѐ`       @    T(`0`X(`0`\#\`#` #dh  '#hDHLP  C        㼨'D'H'L'P'T ''А   @է   P `` O   T ` А b@@g    'T ` А b@@a    '' ,D@(    @Ղ    D@    @x   !,D@(    @n   D `( `((ؐ    @6    '쀠`    P `,'P `0Ā@   'P `@   P `@    @'' c `l@   D(`(`@ @ `     c ``    D(`(`@ @ 0`(`@D(`(`@ @ `80@```     ě(`H@ @ @    $  b @    D(`(`@ @ 0`(`@D(`(`@ @ `0@```     ě(`H@ @ @    $  b @    D(`(`@ @ 0`(`@D(`(`@ @ `80@```     ě(`H@ @ @Ο    $  bД @ p   D(`(`@ @ 0`(`@D(`(`@ @ `80@```  <   D(`(`@ @ 0`(`@D(`(`@ @ `0@```      D(`(`@ @ 0`(`@D(`(`@ @ `80@```         'D(`(`@ @     @    '耠 u   @T    '$$'  ` F    `     `     ` @    ` ;    3    `     ` 1    )   $`     c ``     ě(`H@ @ @     c @ @`p(`0`$  b  @     ' ' H    ' ' B   ě(`H@ @ @     !  c0 @   $@Ժ     !b cP  @A    #    ' ' c ``     ě(`H@ @ @ͩ     c @ @`p(`0`$  cX  @ q   `     ě(`H@(`L@#\#`P#dD#h #lH   TQ    `'L    `'7   Ă `'+   Ȑ   @   И#@ (`#@+` @(` @(`̚@Ԃ#@'T ` (` @ @䀣@     c@ 1       쀠`    T `䀣@   P `,'P `0Ā@ L   'P `@ @   P `@    @'' c `l@ *   D(`(`@ @ `     DD a #aD(`(`@ @ @   D(`(`@?#@  `'    `'   Ă `'   D `(D a`      ` `$ c@<   D `,    @N   D `    @G   D a,    @@        P'D'H'''/D`     H`     ''I   D`      /Ӄ(`8`` 7    " D@    `  (     
@*    `      c@ 0     `(@|    'Ԁ`     `'   `(@n    '   D@j    "   H@    ' `0@[    'Ԁ`      `'   `0@M    '   @   ' ` (` @(` @(` @@   ''?'        @ h    d<' '   '@   '@Қ   ''Ӄ(`8`` Y    " D@L    `      `'  
@˟    `      c@ 0h     `(@    'Ԁ`     c@B     (` @(` @(`؂@ Ԕ @     `      c `` 	    !b `8@U    `'   `(@ҿ    '   H@=    ' `0@ұ    'Ԁ`  L    c@     (` @(` @(`؂@ Ԕ @ c    `      c `` 	    !b `8@    `'H@    ' `0@z    ''쀣@       `0@m    '̂ `'   @      'ā  p'D''''' c `' c ` (` @(` @(`D@ @؎    (`8`'䀠`     'Ѐ` D   Ѐ`    Ѐ` 
    h   Ѐ` ^    b    (` @(` @(`D@ؐ   @     (` @(` @(`D@ @M   ' ܂@ @ 'ԂԐ @v     !b `X @с    4    (` @(` @(`D@ؐ   @ T    `       ܂@ @ 'ԂԐ @M     !b `x @Y       `@ /6        `@ /0       (` @(` @(`D@ "  @    a    c#`    h'D'H'L'P F'' '7?'?'?''|'`'Xl    @       8@   ' '''Ă '''@R   7 c`j(`0``      c`h7^     c`h `7^P``     DD#@ @ @ i      D`     l  @'l    P``     l   @'lP0`	```     l  @'lP0````      c @ `      c@˅    `    l  @'l    l  @'l'P0````      `'P0````      `'P0````      `' c c`l `@ c `@ @' c `'88`     '88@    '44`     '44' c ``  .    c `'$$`     '$$ c  @  `   	         c `'  `     '  	?(     c  @  `?(     c  @  `?((? c `Ё
           ?     c `??ؙЕ	 b @  `H
           ؕ?    Б	? b @  `H??@K    ' c `Ѐc 	    ' b @  `?H@2    (` @Pe   'x@Qd    7fl  @`     @ *     `  
   @ *   ' '     ''X c ``      c `'`     '@    '`2     2''    X@    '  `2     2'  ''`     '' c `Ѐc     'Ё
   	        ?    ??Ђ   !@T   'T c `lT@ $   T(`@H@ϧ    (` @O   $=T(`@H@ϙ    (`=Ȓ  @/   T `'T    `,    @#    `    @    a,    @   'd'l   @`  $      @S    '`      `@ -P   @    @    'H`
    @ )   @ *       ?' a  @ `      a  ``      a  ``      a @ D    c b`    l  @`     l  @`  
   l  @`      [    c ```  (   D @ @Ղ    `      D @ @l     @ "    '||`     D @ @^     a @ ,   ?'?' 2      @    '`      a8@ ,   @ )   @       @ν    '`      a8@ ,   @ )   @        ?'?'l  @`     l  @`  
   l  @`      U   D @ @
     c  h ` @     '`D@#@@ @       @ @%    D<#@@ @       < @    `^(`0`^(`0` `#\^(`0` `#`^(`0` `#d^(`0` `#h "  aX   @ͯ   D @ @    ` ` @     b @  `	 b @  `HH'    @   p   @y   ܕЕH b @  `H '   	        ܕЕH b @  `ȑH' 	   H '
H''H@   '''``      '    ?''HH`    'P'L    'P'LP'LH@쀣@    (`D@ @  `````     (`D@ @  ``     (`D@ @  `0`````     @        @7l   @`     `     @ (^    ' `'(`0`(`0`#@  ?c@(`x@   @   l   @`  
   l  @`         (`D@(`0`f(`0`x#\x#`P#dl'DD#h|@  m   l  @`  
   l  @`         (`D@(`0`#\|@ PxE       l  @`     (`D@(`0` a #\X#`D   x    H @'>   p   @a   l   @`  
   `     @    'l   @`     l  @`     l  @`  
   l  @`          a #\f(`0`#`l#dL#h`DPxv   l  @`      Dx  a c   h   @   hp#@ (`#@+` @(` @(`l@t#@' a  `@       ' `'`     `        `  	   @        c ``      a  a  a #\#`܂#@ `#d$  a  @ x   ` "   `     `     ЕH   	     	   ЕH?    ??' `'ܕЕH b @  `H '   	        ܕЕH b @  `ȑH' 	   H '
H''    `     @/   l  @`     'T c `lT@    T(`@ }@   T `'T   `     @   `     @   `     @    x@˯   ``     `@v    c ``  	   $  bXH@ w    c  @  `  'D'H'L'P'/'# #@ DD ``     DD `  (`   @ `" 'h   DD `#`DD ``    D `    @ 8    `     H    `        D `'D(`  @'d$@X   '``@        '\\`@P   '\\@   `d @ D(`  @ @  @     c @ `      c@    `    P @ f`      c@ j    ``         D(`  @ @   @ l     @ #N    ``     D(`  @ @ @      b b @ (   ``     D(`  @ @  @ A       D(`  @ @   @ 6   D(`  @ b8@  ! @ \   D(`  @ @ @ѣ   `  %    c@щ    `      c@с    D(`  @ @  @ &       D(`  @ a)@  @    D(`  @ a8@  ! @    쀠`      c b(` ` D(`  @t#@@ @       t$ D(`  @ `@   @     c@    ` |    c @ `  v   쀠`  r   D(`  @ @ @    `  f   /[D(`  @p#@@ @       pD @ l#@@ @       l  /   D @  @ @    D(`  @ @ @      @ɱ    `     D(`  @ @ @     `D @  @ @     `          /[[`     D `  @ /   D(`  @ @ 'TT`  B   T@    T@    :   DD ` `#`e   DD ``  ,   DD ``  %    c@ā    D ` DD `  (` `"  	 @  @     ` =   DD ``    4   D ``     'h   D ``     DD @ `(   D @  @ @E    `     D @  @ @     ``      c ``    DD @ `L    /x   @    c ```  Q   D @  @ @    `  H   'D `耣@ A   D(`  @ @  `0`````  .   D(`  @x @  @ g    ``     D(`  @ @ @ |    ``     D(`  @ @ @ D     b b @ &    `'   P @ ` 	   ``         D @  @ @ϼ    `     6   'D `耣@ O   D(`  @x @  @     ``     D(`  @ @  ` @ 3   D(`  @ @ D(`  @ @  ``" `'   ``     P @ 0`
```     DD @ `L 2u       DDP @ `L  j    c cH`     DD @ `@=   DD `  (`   @ `" 'hh  㿈'D 'D     @ȩ        x  /D/HD`'؀`    ؀`    ؀`  ,    ;   ؀`     5   H``      c('     c0'' 3   H``      c8'     c@'' "   H``      cH'     cP''    H``      cX'     c`''  x?'L'PP`    L`      ch@ %   耠`     耠`  @    Кb@@     8       @e    `    @a   ?      `(`0` 2` 
 @N   ?J? c @  `LP c?  @^    O   耠`     耠`  @     	c@     8       @    `    @   ?      `(`0` 2` 
 @   ?ؑJ? c @  `ؑLP c?  @    	   LP c@   L   `'D'HH`
    D`      c@ %<    a0 ` `  C     a0 ` `  9     a0 a0 ` `#\#`#dDH c  @   D   'D'H'L'PD`     a0 a0 @  ``C  " " a0 a0L   ``@C 
"`"`     a0 a0 ` ``C  "" a0 a0L   ``@C 
"`"` c@    ``         P`  	   P @ ' `'       @l   L`)     `(@ $        H@@ ``     H `&X    @A   H `H    @8   hXH   ` @P    7   H `X    @#   hX H@@ ` H@@ ` H@@ `#\ H@@ `#` H@@ `#d H@@ `#h   `  @    c @ c    ' a @  `?@D`     `'<     `'<h$ `<@D@ r        p'D'HD''0', a@ / ?    @0    @ <  @  @     aX'a   H`     a'X    `'8 `'48p    .@ƙ   4@    .@Ƒ   `(`0`  c@(`'0`(`0`  @',0`     ,`         ',`      a'     a' @ a0@Ń   ```(`0``(`8`#\  @ aȘ @n   `	``    a@ / ?    @Ů    @ 0```(`D@'0`     @ 0```(` `H@        p@ b!  a  @7      0`     @ 0```(` `H@    0#@''<``0````  	   <   S+   `" `````  	   <   F+   `" ``0````  	   <   R+   `" ``0````  	   <   P+   `" ``0````     <   A+   `"   @ b`@   ``0````  	   <   U+   `" ``0````  	   <   E+   `" `(`8``  	   <   C+   `" <   +@  `#  p@؂#\#` b!  b  @Ą       @ 0```(` `H@ %     @ b8`@n   p@ (`0`@`(`0`#\#`#d b!  bP  @V       @ 0```(` `H@     0`     p@ (`0`@`(`0`#\#`#d b!  bp  @-      `(`0`  @ b  @   '<``0````  	   <   S+   `" `````  	   <   F+   `" ``0````  	   <   R+   `" ``0````  	   <   P+   `" ``0````     <   A+   `" x    b`@   x   @@   ``0````  	   <   U+   `" ``0````  	   <   E+   `" `(`8``  	   <   C+   `" <   +@  `#  p@ (`0`@`(`0`#\#`#d#h b!  b  @n      `	``    0`     p@ b!  bȖ  @V      `	``    D `'p@ (`0`@`(`0`#\#` b!  b  @5      `	``    0`     p@ b!  c  @      `	``    @ 0```(`@'@ `'`(f   (`  `4@@      c8@   ]   ``'䀠`    (`  c@@      cH@   F     c`@   >     cx@   6     c@   .     c@   &     c@        c@        c@        `@¾        `0@¶         ``@®         `@¦         `@         `@         a@         a(@         aH@~         ah@v       ```  
     ax@h       ``` 
     a@Z         a@R         a@J       ```  
     a@<       ``` 
     a@.    v     a@&    n   ```  
     b@    `     b(@    X     b@@    P     bX@     H     bh@    @     b@    8     b@    0     b@    (     b@          b@         b@         c@         c @   p@@ `#\``#`#d b!  c0  @       `	` b!  cX @v    b'    < \ |      < \ |      4 4  < \ 4 4  4 4     4 T t  4 4 4 4 4 4 4 4 4 4 4  4 4 4 4 4 4   4 x'D'H'L'PD`     a0 a0 @  ``C  " " a0 a0L   ``@C 
"`"`     a0 a0 ` ``C  "" a0 a0L   ``@C 
"`"` c@d    ``      F   P`  	   P @ ' `'       @   L`     cx@ M    ,    c @ #    ' c @  `?HL   'D`     `'     `'ؐ$ c@ m_         'H'L'P'T'X/DH'H' a@ / ?    @    a@ /pq -    @   7n c@    ``         X`  	   X @ ' `'       @\   D``    D``     c cؔ" c@   P`       ` @@@1       T@      @ `( @B   @ (`0``    @ (`0` `p    .@    `      `0@ f   `7n *   @ (`0``     c cؔ", `p@I   @ (`0` `p    .@    `      `0@ <   `7n c @ C    ' ` @  `?`D``     c('\     c8'\pn(`0`#\#`$ ``\@ l~        㿀'DD'D'@ (`0`'@ (`0``     `'     `' a .@    `     @?     @l     `Ȓ @     a   `'D'H'L'PH`      c cؔ"e a @   L`      c cؔ"f a(@   А     @   P'ԂКD    @G    'Ȁ`     ' '    ``  	    `a          c cؔ"l a0@   L `#@ LH `@ @(   @    'ā  'DD @ ? @ @     'l    D @ `      'l    p D@          'l    'll  'D'H'L'P'dh D @>   h HLP @c    '쀠`  E   d `'dd`    h a HLP @          ` @  `d??@      !Hh#\ `x HLP @ 5    ` @  `d??@      !H' @   쀠`           㿀'D'H'H`    D @ (`0`@'`'DH 'H   H`    7D@ /(`0`@'0`  ?c@@'3`@'78 7+`0`   㿈'D'HD`  	   D@ (`8``      `@     DH@    `      '    D@    '쀠`      `H @  @$    '    '  㿈'DD`      a@ g   D@ (`8``      aH@ \    DaP@     `      a @ ' ,    aP@ (`8``      a @ @R    aP(@  a @ D@     a @  a @ `      aPD @@=    a @ '  㿐 a @ `      a @ @&    a @  aP(@   X'D'H'L'P  dhx7T7X/77' c b䀣@ 8   (` ` @T(`0`X(`0`#\\#``#d`#h(`0`#ll#pp#tt#x(`0`#|DH LP @ P        ?'     `'   '  x'D'H'L   dhx7P7T7X/77(`0`p@ `( @>   '' `' `'H`      c cؔ#k a@   D`      c cؔ#l a@w   p``      ap@ u   L     a@?      @     `%$       aL#@    (@k   D @ #@ H @ #`؂ +`	p @ `3 
T3@ X3`\`     \#`    `0````     ܂ `  @=   ``     `#`p;`0`@8` `(`c@@"+`(`0``     3`     a @ ;`0`@8`(`#@(`
 d 3 t`     (`0``     p@ `((`0` t @   p`  	    `( lp@   (`0`p@ ` ؒ    4  c cl`     ` 3`   @     c@  @#    <?c@@ @#  p @ `(3  `  @=i    a @ +` +`	P3`D @ #`H @ #`    4 
|`(`8`#@    P'D'H'L'P'T \hl|7X7/77?'@>,    (`0`X(`0`(`0``#\d#``#d(`0`#hp#lt#px#t(`0`#x#|LPT      '܀`     ?'    DH@ r    '@W   '؁  h'D'H'L'P'TL' @ 0```(`'P#@'''P耣@     c cؔ# b @   耠`    耠`<         c cؔ# b @   T`  	   T``          c cؔ# bH@   T@     b`T@    DHLP@     '    T@ @<8   'T@L @f   ' 'T@'    T@  o   T@    䀣@     T@    '    T''   2Ԃ  T@    0`4 Ԃ  T@    @䀣@    `  @3    4 
Ԁ`    @L@Ԃ  T@       @    @DHؖ @      '܀        Ԃ `'   @e   'Ё  h'D'H'L'P'T'XX'''HLPTX\@    '耠 I   @;"    'ܚ @ @ '؂ؐ @    @    #\ bDHP \@ 4   䀠`    ܀`    ܀`    ܀`~    ܀`        ?' $    @ (@' b@     !b@   @    `'耠        LP  S   'ԁ  P'D'H'L'PL'''/L`      c cؔ$/ c@   P`      c cؔ$0 c @    c c`      @ 0```(`P @ c c@     cDHLP c[    '    H`  W   P ` @:   '̂ ` LP@   'H `  @    ` H @
   ( 3`H ``     H `     'Ȁ`  	   H ` c8 @ C    /    H `'P `̔ @9    'ܐ LP     @S   '' i   D`      c cؔ$H cp@       @#    7P` A    `'`	``     @ 0```(` `P@     @ 0```(`؂@'`7    `	``     @ 0```(` `P@     @ 0```(`؂@'`7 #\ cxDLP      ''  x'D'H'L   \`h7P7T7X//7  `'%'' '/ /``    ``      ' <   ``    ``      '   @    `0' 7 #   ``    ``      '   #@  `#   7    `` c  @ W   (`0``  %   (`0`''耣@    ' @'(`0`''@    '  @?   /X7T77A   7 c cl`      7@:    (`0` c(`0`#\l#`DHch @ 8       P'D'HD'D `'D `(''D`      !b c@	   ?'&    `' `'`(`0`  c@'`(`8`'' @    Ȑ   @    @ 0``` `0`@(`'`	``    `  	    c@t       ' @    @ (`0``(`0` ` 
 @[    `8@W   ```      `@@M   ``0````      `H@@   ``0````      `P@3   ``0````      `X@&   ``0````      ``@   `````      `h@   ``0````      `p@     `x@   `(`0``` `  @   ````      ` ` @    "   ``0````  
    ``@       ``0````      ``@   H`  1   @ ,    `@   @    Ă@@ `'Ă ```       '     
' `@   Ă `'    `x@   '  P'D'HD'D `'D `''D`      !b `@   ?'     `' `'`(`0`  c@'`(`8`'' @    Ȑ   @h    @ 0```(` `'`	`` ,   `  	    c@6    !   ' @p    @ (`0``(`0` a 
 @   `` a8 @   H`  1   @ ,    `@   @    Ă@@ `'Ă ```       '     
' `@   Ă `'    `x@   '  p'D'H'L'P  \d7T7X77' c b耣@ -   (` ` @T(`0`X(`0`#\(`0`#``#d(`0`#hDH LP @          ?'     `'   '  x'D'H'L   `7P7T7X7(`0` ` @75   '' `' 'd @ H`      !b aH@   @   '    L     a@8L      @     `%$       aL#@    @   P3@ T3` `3`\`      `(`0` \ @   D @ #@ H @ #`܂ +`	 `3`
(`0` `ܒ x   4  c cl`     ` 3`ܒ   @[     c@  @#    <?c@@ @#   `3`X3` a @ +` +`	D @ #`H @ #` ;   4 
d`(`8`#@ '؁  h'D'H'L'P'T \`h7X777?'X(`0`(`0`(`0`d#\(`0`#`#dLPT      '܀`     ?'    DH    '@   '؁  㿀'D'H'L  'X\/P7T7(`0` ` @62   ''H`      !b a@   @   ' `   L     a@7Q      @     `%$       aL#@    @     c@  @#    <?c@@ @#   `3`T3` a @ +`P+`	D @ #`H @ #`    4 
X`      `(`0` X @    ``(`8`#@ '  p'D'H'L'P'T `/X7?'@6    (`0`X`(`0`#\#`LPT \\    '`     ?'    DHY    '@>   '܁  㿈'DD @    `'D @       H'D'H'L'P'T''T`     T    @   D`      a@    L`      a @ `      a܂ #@  aL@    'LD@^^    'Ѐ`     D@_:     b8 @    Ѐ`q ,   Л(` 	a0@@     ' N    ' J    ' F    ' B    ' >   ' ;    ' 7    ' 3    ' /   D @]   '`      a @	   D @]   '  ab@     b`@ q    b@    @     @    L`        @	   D @]   'Ԁ`  ;   쀣@    H @ '    쀠`  )   T`  %   T#@ T#`쀠`     c cؔ&c b@$   T `''`     '@    @'Ԁ`     @ `0`````      (   L`      '     L`        @   #@ (`#@+` @(` @(`@Ě#@L@     '̀`     Ԁ`    @ `0````` w   ̀`     H @ ' e   H#@#  H a@  @ @     a aH @ @ @d   $   a @ `     H c@ @     aH @ #@  aH @ @ @B   P`     P#@ P#`؀`      c cؔ& c0@x   P`      aH  @ @ P        aH  @ @       a @ '       p  p  p  p   p    $  @  p  4  p  p    $  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  $  $  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p  p    P  p  p  p  `㿐    㿀'D'H'LH'@ (`0``     c@@    D` 4   ' a @ @ )     @ @(` a @ @ @ `       @ @(` a @ @ `L  @Z    '     `'   '    D`     c cؔ& cx@    a a@  @ @     a @ `      a  #@  	    a a @ (`#@  a a a @   @ @(`   @2   $  ' a @ @ )     @ @(` a @ @ @ `       @ @(` a @ @ ` L @    ' $    `'     @ @(` a @ @ `#@   @ @(` a @ @ ` L @    '  P'D'H'L'P'T''D`      c@    P`      a @ `      a #@  cP c@ (   'PD@[    '쀠`     D@\^     b8 @    쀠`     ` @    P`        @~   D @["   'Ԁ`  "   `)    Ԃ `  `p 
@p    `     Ԃ `H  @Z   Ԃ `L  @S    >   Ԁ`  *   P`      ' ,   P`  (      @?   #@ (`#@+` @(` @(`@Ě#@P@     '     @  ` @  2     'Ѐ`        Ѐ`     ' !   T`     T#@ T#`؀`      c cؔ'? c0@D    Ԕ *T6    '  㿈'D'H'L'PH`  
   D`     L`      ' _   H @ ` 	   H ``         ' O   P`     D@     `      ' @   L#@D@         @ @  ``      ' ,   H `  ` @    `      '    D@    `     D@     ``     H `D @ r   '     '  'D'H'L'P'T  ab' b' a ' ''P'L'/k@ (`0``    @ (`0``         ` `@    D 2  N    'pH@ ` H@@ ` H@@ ` H@@ `#\ H@@ `#` H@@ `#dDp `   @    D    'Ԁ`  	    ` `D@ _   'dd a @   d ` H @   d(3` `'d `'`d 3@ d( 3`d +`d +`d 3``H @   ` ` `   @   ` `
  a @   ` ` `   @      @      @   k``  |   ܀@ w   Ԓ  *@    'tt`* 
    a `t *@ #      *    ؂ `''xk``       @   ؛(`@#@ (`#@+` @(` @(`@#@ @'||`     x`          a'|x `'xlpT |     'tt     ah `@    t`   l `@        /k   p@Z   k`   P'DD@h    `     '    D@     `      '    D@     ``     D@ l    `     D@ e    D @ *    '    D@      ``     D  @        D  @ ߣ    ``      a a@ 3      D    ``     D @     ' U   @	    '  @    @    `      `       `D @     ' 0   D   @ ;   D@    D@              ``           D @     '    '  x'P'T'X'D'H'LܚؘD   @[p    `  	    aD @    P' , L@]    k     b @     c ``  
   $  bXD @ Z   H    @\$    `     H@X     b @ x   H @Y<    `     H@X     b @ f        x'D'H @ B    '쀠`     ?' ;   '耣@ 3    (` @(` @(`@ ` '@ (`0``        H @ `      (` @(` @(`@D   @-   ' 	    `'   ?'܁  㿀'D'H @      '쀠`     ?' 3   '耣@ +    (` @(` @(`@ `D @    `      (` @(` @(`@ ` H  @   ' 	    `'   ?'  x'D'HH'D@ (`0``    D`(`0``        '     ``      `(`#` `(`@  @W   $   `(`  @D `#`D`(`0` `(`  @ `   @    `(`  @D `#`' `耣@ C    (` @(` @(` @ ` ' (` @(` @(` @a (`0`   @?(@' `@D `@      `(`  @ (` @(` @(`  @"      `'    `耣@    D ` @d     bВ @ Z   '     ` `#`'܁  0'D' a@ `` m    a +@  ' a (` @(` @(` @-   $      @V    '耠`      c(@ S     '@-   '''0a @    `      c@@ 
   '`      cx@ 
     '܀`    @ (`8``    @܀@   @ (`8``        ܂ `'@ (`0``        a @  (` @(` @(` a @ @ `   @<    a @  (` @(` @(` a @ @ ܔ @,     a @  (` @(` @(` a @ @  :@C    '`     (@  a @  (` @(` @(` a @ @ ` ܔ @+    ܔ @+    `  @   0a @    '`     @     @ `~ 
    c @ 
    .   `      a @  (` @(` @(` a @ @  3a      `' ` a @  (` @(` @(` a @ @ a   @    ܔ @+    `  @   0a @    '`      c@ 	   7(`0`0````      a @  (` @(` @(` a @ @ #a$    (`0`0````  m    a @  (` @(` @(` a @ @ a$ a @  (` @(` @(` a @ @ -    '`      a @  (` @(` @(` a @ @ ` c @ 	    @    `      a @  (` @(` @(` a @ @ ` c @ 	e    a @  (` @(` @(` a @ @ a)   @    +   (`0`0````      a @  (` @(` @(` a @ @ #a$     a @  (` @(` @(` a @ @ #a$(`0````      a @  (` @(` @(` a @ @ +a(     a @  (` @(` @(` a @ @(a( a a @  `#@  a @ 쀣@ $   (`' a a (` @(` @(`   @   $   a @ `      c cؔ)X a@    a @  (` @(` @(` a @ @ a @  (` @(` @(` a @ @(`+   @'   @   @   D`     D a @ #@  a @    x'DD''@ (`0``     a( a@     h    ''@ .   ܂ (` @(` @(`@ ` '@ (`0``         ``     ܂ (` @(` @(`@'    ܂ `'   '؁  㿀'D' )    ''耣@ 6    (` @(` @(`@ ` D@    `      (` @(` @(`@ D@    `      (` @(` @(`@'     `'   '  㿀'D'HD'H' ``     '     ``     ?'     '  8'D '' a @ ` F    a(` @*|   $  Ȑ     ' aX ah@    '耠`     $ @    $ @    `      ap@6    'Ԁ`      ax@       @ (`8``*       ؐ Ԕ @)-      ap@    '' b  @ (` a @ @Ԓ  @   $ Ѐ`     @ (`8``          a@          ap@    'Ԁ`        ' b  @ (` a @ @Ԓ  @`   $ Ѐ`     @ (`8``          a @ d   'Ā`       ap@    'Ԁ`         Ă `'   Ԁ`     Ě ` b  @ B   Y   ' b  @ (` a @ @Ԓ  @   $ Ѐ`     @ (`8``          bP@    6   'Ȁ@ .   Ă (` @(` @(`̂@ `  @    `      b  @ (` a @ @Ă (` @(` @(`̂@#      Ă `'   Ȁ@ 
    b @       Ă (` @(` @(`̂@'a (`0`   @?(@' ` ' b  @ (` a @ @ ``  n    `@ b  @ (` a @ @ `@  \   'Ȁ@ V   Ă (` @(` @(`̚@@     B   Ă (` @(` @(`̂@ @    `  1   Ă (` @(` @(`̂@ ` ' `@ b  @ (` a @ @ `@      b  @ (` a @ @Ă (` @(` @(`̂@#  Ă `'    b  b  @  `#@  b  @ 쀣@[   (`' a a(`@  @   $  K    a @ ' b  @ ''''@~    '`      b aH@     cp @    `      b aH@    @o   ' b #@  a#@  ' b  @ @    ě(` a @ @ě(` a @ @  @        Ă `'    b  @ @     a b @  @   b@U   D`      b@    D b  @ #@  a @    `'D'H'''D`      c(@ r   D'@ (`0``     cP@ e    c ``      c0@ (`8``          c ``      c  @     c0@ (`8``          ' c0@ (`8``      c0    '耠`      c c0@ !   耠`     a (`0`   @?(@' ` ' `̘@ `̂@     H +a0 D   H(a0ؐ     ''؀@ 6   Л(`@ @ @    `  %   Л(`@Л(`@  `@Л(`@ `@     H b8'Ȃ 3@ Л(`@ `# Ђ `'   H!0@e    c ``     H a8  ! @W       H a8 `   ! @L    'C        ''䀣@    Ԃ (` @(` @(`@ ` '@ (`0``         ``  d   Ԃ (` @(` @(`@ a$` W   '䀣@    Ђ (` @(` @(`@ a$`        Ђ `'   䀣@ 8   H +a0Ђ (` @(` @(`@H !0@    c ``     H a8  ! @       H a8Ԃ (` @(` @(`@ `   ! @    '    Ԃ (` @(` @(`@a (`0`   @?(@' `̘@ `̂@  8   H +a0Ԃ (` @(` @(`@H !0@    c ``     H a8  ! @       H a8Ԃ (` @(` @(`@ `   ! @q    ' h   Ԃ `')   H(a0ؐ     ''؀@ T   Л(`@Л(`@  `@Л(`@ `@  9   Л(`@H @ !0@;    c ``     H a8  ! @-       H a8Л(`@ @  `   ! @   H b8'Ȃ 3@ Л(`@ `#  '    Ђ `'   '  㿈'D  ' 'D  ?c  ` @    `      c ``      c@    c ``     D  ?c  ` @   $  c@ Q        㿀 c( @ `      c( @ ' 7     @    `  -   '  @    `      c ``      `@M     @    `      c(#@  c( @ '    '    '  㿈'DD @    'D @       㿈'D 'D  ?c    @    `      !b `(@    ``@        'D'H'L'P'TP''`    @   D0` (`@ (`@D` (@?p@"pT`     T @ D ``      @    '쀠`     DHL  @    '쀠`     '\     `p@   '\    쀠`     T`     T #@ '\     `@   ?'\\  x'D'H'L'D `'D `0`(` '耠`  h   @ ``  b      @ `'`#  䀠`      T   䀠`     '      @ `'`#  `     =   耣@     6   䀠` '   `
 #   H`     H @   HH@  @  `'L`     L @   LL@  @  '    #@'@ '   H`     H @ L`     L @ '܁  㿐'DD @ D `D@          㿐'DD @ D `D@          㿐'DD ``     D `@   D @ D `D `D `D `D `  㿐'DD ``  
   D `@   D `D @ D        㿐'DD ``  
   D `@   D `D @ D        㿐'D'H'LD ``      c cؔ+l `@L   D +`DL@#   $ D `HL@   DL#@ DD `#`D ` @ <  @  @     c cؔ+r `@%   L`     c cؔ+s `@   D ``(`8`L@     c cؔ+t `@   D ``	``    D ` @ 0```(` `L@ P   DDD ` @ 0```(`  @" B   D ``	``    D ` @ 0```(` `L@ /   DDD ` @ 0```(`  @" !   D ``	``    D ` @ 0```(` `L@    DDD ` @ 0```(`  @"     㿐'DD @ D `D@          㿐'DD @ D `D@          㿐'DD ``     D `@   D @ D `D `  㿐'DD ``  
   D `@   D `D @ D        㿐'DD ``  
   D `@   D `D @ D        㿐'D'H'LD ``      c cؔ+ `@:   L`*     c cؔ+ a @-   DL@"   $ D `HL@   DL#@ DH `&#`     㿐'D'HH  ?c@ 
   D`     a0@q        㿐   ?c        㿈'H'L'P'T'X'DH'( D@ M    cc``  	   H' D@ L    cc``     ('    ( ' a@ ND    @m      㿈'H'L'P'T'X'DH'( D@ L    cc``  	   H' D@ L    cc``     ('    ( ' a @ N        㿀'H'L'P'T'X'DH'( D@ L    cc``  	   H' D@ L   @@     @ @	   '@9   ' cc``     ('    ( ' a( @ @ M    cc``     $ @ N6    !b@"    @      㿀'H'L'P'T'X'DH'( D@ L[    cc``  	   H' D@ LM   @     @ @   '@   ' cc``     ('    ( ' a( @ @ M    cc``     $ @ M    !b@        㿈'D'H'' a8@   'H@ (   D@@ `' aH@    ```      aP@        ```      aX@    `'    aP@        p'D'HD' bh@   '''H0`'H0`'''؂ '؀`     @ (`0` bp @k    `' `'``    ؀`  3   H```      ``     @ ` bx @I   Ђ `'ؚ#@  @'؂ '؀`      b@6      Ѐ`      b@,    aX@(   Ԃ 'Ԁ`  (    a`@ `@(`8` a` @@ ` (`8` b  @
    `'܂ `'܂``     bh@   Ԁ`    H```     ܂ ``      a`@ `@(`8` b @   H```      ``     @ ` b @    a`@ `@(`8` b @    aP@        㿈'DD@    '쀠`  "   D@(`8``
    쀠`    D@(`8``    D @(    D @(D   㿈'D'HD@ (`8``  B   H@ (`8``  ;   D@ (`8``_    D@ (`8``-        H@ (`8``_    H@ (`8``-     ' .   D@ (`8`H@ (`8`@     '    D `'DH `'H   D@ (`8``     H@ (`8``          '    '  p'D'H'L'P  7T7XL;`0`@8`''D'P`     'PL``  
   P b @ ?'    D`  	   D@ (`8``     '    ܀@ 
   P c @ ?'    @ (`8` @    `  
   P cX @ ?' p     
@	    'T(`0`@    X(`0`@     
   P c @ ?' P      @H 3  `" '@ (`8``,    @ (`8` @    `          `'   @ (`8``     @ (`8` @    `  
   P c @ ?'    쀠`     @ (`8``     v   'ԁ  p'D'H'LL`        H`    DL@         L`     '    L  ?c@     '     'L@     @_    'H@Z    'L@     @$   '''L '쀠`  ^   L`    @ `' `'    L  ?c@    @ (`0`'܂ `'     @ '؂ `' `  @T    'H@    D@Ԓ H@   H@    D@H@    D@  H@   H@t    D@ H@    '   @   @        㿀'D'HH`     8   H '䀠`  1   @    (`0` `  @L    '쀣@         @D@@ 7 @D@ @D@@ 3   @D@3@  '     㿀'D'H'L'P'H@L#@D    @    '쀠`      @'L@    쀠   @    `   쀠`     L'    ?'   㿀'D'HD`      ' 4   H @ 'D 'DD`  (   H `'H @ '耣@    '''耠`      @q    '''   D 'D   '   x'D'H''H @ ?c @ D  @     	   ??c؂ @ @ 4   $ @    '  $ @    `V#@  `'?c?c @ @?c @`    ?c @@ (`8``     ?c @@ (`8``     ?c @@ (`8` @     `     ?c?c @ ` @   ?c @@ (`8``"    ?c?c @ ` @?c @ "@     ?c @ \   ?c @@ (`8``'    ?c?c @ ` @?c @ '@`     ?c @ :   ?c @@ (`8``     ~   ?c?c @ ` @?c @@ (`8``     ?c @@ (`8` @    `     ?c?c @ ` @   ?c @`     @  g   ??c؂ @ @  Z   耠`    @  Y   ??c؂ @ @  L   ?c?c @@ (@?c @(@ ?c @@,       (`  @ `" ?c@(`8``     ?c?c @ ` @    ?c?c @ @   (`@ `H#@ ?cؚ@#@ ?c؂ @ @   㿈'DD 'DD @  `V@     `8 `X! `h@   D `' @ `      @ @    `'   D@        㿀'D'D  
@    '쀠`     耠`     ?' {   @ (`8``     ' p   @ (`8``s    @ (`8``S         (` @(` @(`' V   @ (`8``m    @ (`8``M     &    @@ (`8``s     @@ (`8``S        ' .    (` @(`@+` @(`' "   @ (`8``h    @ (`8``H         (` @(` @(`#@+` @(`'    ?'  㿈  /D/HD` @?    `     H` @6    `     ' ?   D` @    /DH` @    /HD` @    `  	   D` Ѓ(`'    D` (`'H` @    `  
   H`@ '    H`@ '`'  x'D'HD'D'@ (`8``     @ (`8``\     `'@  '܂``H    ܂`(` "c(@@    / `'     / `'     / `' |    / `' u    
/ `' n    / `' g    	/ `' `    / `' Y    `'@ (`8``      @@ (`8``     ' i   @ (`8` @r    `      @@ (`8` @e    `     ' N   @ ` @@ `     / `'    @ (`8` @    `     ' .   @ / `'+@  `'J   耣@    @ (@  `' `'9   (@ H`     HD#@#  D'   L 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 d  4 4 4  4 4 4 4 4 4 4  4 4 4  4  4  4 ('D'H'LH`     D`  
   @K     #@ '\ M   H?#@ hD @n     
   @7     #@ '\ 9   DL@d    'dd    '\ ,   L`     L`     'X     'X     'X  X d  @   '`d@   `    '\    H @ `'\\  'D'H'L'''؂ 'Ԃ?'' c`j(`0``  
    c`h(`0`'     c`h(`0`@    ` ' c @ `     @     c#@  c @ `     @     c#@ '(`@   @   D@ ȥ    D@     DD c   (`0`Dd(`0`#\ c     (` @(` @(` c @ @ `#` "   c @ #d #h#l `#p #t#x#|d h 4   ܂ `' `'D `'   @P    	   ؀@        `     D(`@ #@ (`#@+` @(` @(`@(`@ Ě#  @'`     'D dȒ    m   '   @   `     @ 0```(` `@       `	``    @ 0```(`@'`(`0`@ #   `(`0`#@䀣@    @ (`0`Dd(`0`@    ``0`````      b   `(`0` c`h(`0`@ 7   `(`0` c`h(`0` a@ *    c ``     DD `애 aX @  `HH' `     DD `애 aX @  `HH#`؂ `'9    c ``3    @ @ ' @     a    `(`8` ޼      `(`0`#@'؂ `'`(`0`'(`@D `   @ I       	   Ԁ@       H`     H#@ L`     L#@    㿈'D  7H7LD`    L(`0`H(`0`'@' (   D` "   H(`0`0`H(`0``(`@7HL(`0`0`L(`0``(`@7LL(`0`H(`0`'@'    ?'  㿐'DDDD0d7d'$DD0d7dD a` @  `'d'dD dD dD dD?'dD d  0'D'H'L'' "U`@''''7fD`      a a!3 a@   H`      a a!4 a@   @    ''`     @({P `'   D   D ` @ d   D' c ``      c `7     d73dD' c ``      c `7     70dD  ab#dĂ H!@S     :@    'Ѐ`  1      +@  `#  DВ  
@    4$@ (`8``     ̀`     @ (`8``  	   Dd(`0``  (    aHz    !   D' c `l`      c`p7     c ``      c`7     P73$D @ !    c@        t    `      b =   D @    D  @          ``      b8H     c ``      c  @    D @ Ň   D c0 c0@         `D  @     a8D ! @ o   8``     D @ ƃ       D  @ }    b8D ! @ ƨ   D,@   ,`      a)D @ Ǉ    c ```  O   D@    `  H   D9    ``      b ah   D@     D dА   @T   D@     D d֐   @I   DD@q     '   $$D d܀`     D@d     b ah    D?#dDD d#d #   D   @   $$$̀`      c  ah   D dY   D d   D d   D dD dDD@.     c ``  @      2   $$D@     @V    'Ԃ#@D@        @>     @F    'КDd(`0` "  cК @   @H   @E   D@    D dȔ K   @    '쀠`U    c `Ѐ`       @     
   쀠`       a0@|   D@ ī    D@ "    DD c c`h   `(`0`Dd(`0`#\@ `#`#d #h#l `#p #t#x#|d h H   x(`@   @j    `'쀣@   ؀`    쀠`    '    #''Dh dȒ ܖ   ߞ   '`p   @B   ``  '   쀠`       (`@p {#@ (`#@+` @(` @(`t@(`@ {# 䀣@    '   (`@p {#@ (`#@+` @(` @(`t@(`@ {# 䀣@     'f(`0``     ``(`0`f(`0`@       ``7f` @ 0```(` `@    u   ``	``o   ` @ 0```(``@'\\`(`0` c`h(`0` `@ &   \`(`0` c`h(`0`#@`    \@ (`0`Dd(`0`@    \``0`````          c ``/    `@ @ '   @     cP 	      ' `'Ț @@``3{XȂ @ +{Pxȃ(`@hD `   @ b      ''` !    @{P``     耣@     @@ @@{X3;X `' `'   耠`     D@    D@    Dd(`0` c   z   DH   @ .}   $$D d `    D@    D@    D d    Dd(`0`$ `(    @ ?       D@    D@    D d    Dd(`0` `X   8   D @@{V3$D'Dd(`0``    Dd(`0`'	?     c @  `? d d耠` U    c ``      `Ȓ 7   D'Dd(`0``    Dd(`0`'	?     c @  `? d dD'DDd(`0`'dd
           D d d? 
   Dd(`0`'	? d dDD d  c@#$L`     '쀠` <   쀠`       0cP@3   D@     DD c c`h(`0`Dd(`0`#\@ `#`#d #h(`0`#l `#p #t#x#|L h     `'    $c@   D    <    'Ā 	   D    1    'Ā`     D@    D@     a  S   DDd(`0`ă(`0`$      'XX`     D@    D@     ah  2       X`    D@    D@    D d     aȒ       c ``     X`     cpX;   D3d   'D'H'L'P c ``    DD d#\$  cLPdd@ >\        c ``     LP@    DD `0LP d d   LP@    D'Dd(`0`'D d d ` @  `H
           Dd(`0`'?    D d d ` @  `H? d dDD d  	c@#$D'DD d'd'Ԁ@    '#dD'Dd(`0`'	?DD d ` a  @    '$$
   	        D d d           D d ` a  @    '           Dd(`0`'	? *   DD d ` a  @    '$$
   	        D d d?    D d ` a  @    '	? d d    LP@ P   D'Dd(`0`'D d d ` @  `H
           Dd(`0`'?    D d d ` @  `H? d d c$ @ `      c ``      c$ #@ D@3    D@b     `      r   DD d ` @  `HH#dD da    D dD'D d d a  @  `H?D d ` a  @    '
   	        D d d a  @  `H?    D d ` a  @    '	? d dD'Dd(`0`'D d d   	        Dd(`0`'?    D d d? d d c ``    DD$  ` d d$@ <        h'D'H'L'P'T'X'''''| c  @ `     @     c #@     @1       @+   Ȑ   @   T`     T   @   X`     X   @   D d̀`  >   Hu    ``      b a   H@     X   @   H@     X `   @   H@     e   'dd`     H@     b a        'd'P@ `    c `Ѐ`       @        D d`  
   `     D d@)   D@    'TH@    'PD'Ld`     X'H    'H cDd(`0` @L@@ (`0`#\ c  @ #`#d #h#l `#p #t c `#x c `ă(`0`#|LdHTP#h     `'      @   ?''H `  @ @'DD/@    'DD`2     2'DD#@    Ȃ @'H `  @ @'@@/@    '@@`2     2'@@#@     (` @(` @(`̂ @' А b@@     @' А b@@    'H ` А b@@|    Ȃ @'H ` #@r     #@p     (` @(` @(`̂ @' А b@@]     @' А b@@V    'H ` @H `@'<<#@F    '<< K     K'<<#@:     @'H ` @H `@'88#@+    '88`K     K'88#@"     (` @(` @(`Ă @' А b@@     @' А b@@    'H ` @H `(`@'4 4b@@    '44`     '44 @'H ` @H `(`@'00#@    '00o    /'00#@     (` @(` @(`Ă @' А b@@     @' А b@@    '耠`    @     ',``    ',,'|耠`    |`         耠` 
   耠`    |`      '   @   (`@ #@ (`#@+` @(` @(`(`@  #@'`     䀠`  
     0cO@        耠`     a    !' c ``     a    `     @P   ܚD      '܂@'؂@'`  J   DDd(`0`(`0`$  *    '䀣@     c ``      ah   #@'쀣@    '   @3       쀣@    Ԁ`      c `` 	    a   P@    P`    P@     @  ` @         @     c ``      bHv   DD d  c@#$D'(DD d' d'$$       '$$(#$D'Dd(`0`'	?DD d ` a  @    '$$
   	        D d d           D d ` a  @t    '           Dd(`0`'	? *   DD d ` a  @V    '$$
   	        D d d?    D d ` a  @<    '	? d d    DD d b @  `HH#dD da    D dD'Dd(`0`'	?DD d ` a  @    '$$
   	        D d d           D d ` a  @    '           Dd(`0`'	? *   DD d ` a  @    '$$
   	        D d d?    D d ` a  @    '	? d d쀠`  5   P@ 0    c ``    Ș#@ (`#@+` @(` @(`@̚#@ bP @   T`     T @  `X`     X @  ``     D3dd`     'd   㿈'D'H'L'P'T'X'DHLPTX    ' `'쀠` 1   耠`     P@ (    c ``  	    bP   @-     @_   쀠`     -@X   DD    r    4$   耠`  	   P@        D@    D@*     c0      c ``    L@ (`0` cP       @'D'H'L'P'TP `;`0`@8`'P#@'?'܂?'؂?'?'' c ``    H@    L@ (`0` c P Tx   DDHH `8dd$ k   КDHL F    '쀠`    䀠`     DHL    'DH    @L@DH       '耠`    `      @L@DH     'DH   ܀    '    ''؀    @'    @''@@ L   T@    T     A   䀠`      c ``    L@ (`0` `x    ИH `   @ J   `      c ``     @L@@ (`0` `x    H `   @ )   T@    ܀ c   DHL        '䀣@ T   쀠`    `     'DHL    'DHL        c ``     L@ (`0` ` l   DH2   #@ @''쀠`    䀠`    `     H ``L@ (`0`   @ J   ؀ q    @L@DH         '@ ^   耠`    `     ' @L@DH u    'DH        c ``      @L@@ (`0` aX    DH   #@ @''耠`    `    `     H `` @L@@ (`0`   @    쀠`    䀠`    H ``L@ (`0`      @ m   耠`    `    H `` @L@@ (`0`      @ U      H'D'H'L'P c@ (`8``      c(@    c +@  4c<@   'L`     r   P`      aI    c0@ (`8``      Pc0@    `      a4   D`      a a# b8@   D  @ {    ``     =   D@    `    D@ a    $  b@ @ 5{   *   D  @     c0@ (`8``     D@ -     c(P     c ``  
    c ``         D@ 1    $  b @ 5K     @    'D `耠 C   D `쀠 >   D' c( ` @'  Âa@Ԁ@      Âa@' `D' c( `  	c@     c( `' `̀@ 
    `'      	c' `DDD `(`  @" 0   D' c(D `'`'@    ' `D' c(D `'`'@    ' `DDD `(`  @"L@ ,   L#@' c( d dHH'''@    '' @H@ c(D ?   @'    c ``       @J    #@'܀`     b'     b'$  bL@ 4   'L@ )   D `` @H@@ (`0`   @     `     D `` @H@@ (`0`      @     `'   D  @         㿐 c(@T         'D'H'L  7P7T' `'!,' `' ' `8@ ``      `8@	d      <@     `A,   `8@ ` @    `:@ (`0``  
    `:@	G    4     L`     T(`0``     H`     D`          !b b@   '     `4 @ `      `4  @      @     `3$  ' c b@    (` ` @'    @b   P3@ T3` `3` @ #@ L @ #` +`	 `3`
 ` O    73` c cl`     ` `3`   @.     c@  @#    <?c@@ @#   `3` `:@ 3` `4 @ +` +`	 @ #`L @ #` `     4  ` `3`
 c b@ )    `  `3@  `  `:@ 3` ` P3` ` T3` ` 3`
 `  `3` `  `8@ +` `  `#``(`8`DH      ' 	    c8@   ' 
    `';    ` '  p'D'H'LD @ 0```(`D@'Ԑ#0@z    ' `#` @ a#`!@ a#`!@ b #`" @ b#`"@ ` c`#@  `  ch@8    @ cp#@ D`(`0`0````      `  ch@!    	    `  cx@   !@ c#@  a`(`0`  c @   !@ c#@ L ` @     a  c@        `L@     a  c@    	    a  c@   " @ c#@  b$'``0````  	      B+   `" ``0````  	      U+   `" ``0````  	      A+   `" ``0````  	      P+   `" ``0````  	      R+   `" ``0````  	      S+   `" `````  	      F+   `"    +@  `#  "@ c#@  b' `0`(` 'Ԃ `'耠`     #@ }T`| x      @ (`8`'`#   '䀠`        L+   `"  _   䀠`       N+   `"    䀠` (      M+   `" ؂ `'؂ ؔ @   (`0`H@ 	      E+   `" ؂ `' '   䀠`       W+   `" ؂ `' '   䀠`      T+   `" ؂ `	' '      +@  `#     `'D'H 
''D`	`` 	    c   '(   DH ``     '   D @ 0```(`D@'@ `` 
   ```        '    `' `'@ (`0`H`(`0`@    `(`0`H`(`0`@        '    (` @(` @-   '' Ѐ@    Ђ (` @(`Ԙ@Ђ (` @(`Ԃ@ `# Ђ `'   ̂ (` @(`Ԛ@ c`#@ ̂ (` @(`Ԃ@ `  ch@+   ̂ `'̂ (` @(`Ԛ@ cp#@ D`(`0`0````     ̂ (` @(`Ԃ@ `  ch@       ̂ (` @(`Ԃ@ `  cx@   ̂ `'̂ (` @(`Ԛ@ c#@ ̂ (` @(`Ԃ@ `D``  c @   ̂ `'̂ (` @(`Ԛ@ ` #@ ̂ (` @(`Ԃ@ `D`(`8`  c @   ̂ `'̂ (` @(`Ԛ@ `#@ ̂ (` @(`Ԃ@ ``(`8`  c @   ̂ `'̂ (` @(`Ԛ@ `#@  `
'@ 7(`0``     ̂ (` @(`Ԃ@ `  `@v    0   0@  ĭ    (`0`(`0`@    ̂ (` @(`Ԃ@ `  ` @X       ̂ (` @(`Ԃ@ `  `(@I   3@ ̂ `'̂ (` @(`Ԛ@ `0#@ `(`0``     ̂ (` @(`Ԃ@ `  `@%    )   `(`0`H`
(`0`@    ̂ (` @(`Ԃ@ `  ` @       ̂ (` @(`Ԃ@ `  `(@   ̂ `'̂ (` @(`Ԛ@ `8#@ ̂ (` @(`Ԃ@ ``(`8`  c @   ̂ `'؂ `'D`(`8`D@'Ā@    @ `H``@        Ȃ `'   ̂ (` @(`Ԛ@ `@#@ Ā@    ̂ (` @(`Ԃ@ `  `(@       ̂ (` @(`Ԃ@ `  ` @   ̂ (` @(`Ԃ@ `'  0'D'H''7''''x  bi'X'T ` @  `?H'D'@ '<' ` @  `?D  @     ``     'L   H `    @   H `H `H `T    $@z   d  @,    c ```  ;   D@?    `  4   D@ k    h   @   D@ s    h `   @   D@|        'tt`     D@|	     `X `H *   ?'h'd       @{    '`      `x      F      'd'tD `'H  Âa@H@      Âa@'HH'D ` (` @'D a D@     a 'DD'D@{     c ``  @   a #@U             ' c ``     a #@@    $  ` @ ./   `#@D@ X      ` @    D@{I    P "  `  @g   D@{{    P     D #`\?'`D `X?#aD `X?#a'TD ``     @     'TT`     T@ (`0`'`D `XT@ (`0`#aD ``     @     'TT`     T@ (`0`'XD `XT@ (`0`#a $   D ``     @     'TT`  	   T@ (`0`'X    @       a@k      a0@'X c ``     ` 	   $  ``X@ -    c`h(`0` `'x`     '@     '@@'t'''|`    Ā`  ,    c `Ѐ`       @    D@ /     cx(`0``(`0`d#\#` B#d#h a@#l #p#t#xd #h     Ȁ`  ,    c `Ѐ`       @    D@      cx `(`0``(`0`d#\#`#d#h a@#l #p#t#xd #h  ¦   ̀`  -    c `Ѐ`       @    D@      cx `(`0``(`0`d#\#` +#d#h a@#l #p#t#xd #h  w   Ѐ`  -    c `Ѐ`       @ X   D@      cx `(`0``(`0`d#\#` #d#h a@#l #p#t#xd #h  H   Ԁ`  -    c `Ѐ`       @ )   D@ u     cx `(`0`X(`0`d#\#` #d#h a@#l #p#t#xd #h     ؀`  -    c `Ѐ`       @    D@ F     cx `(`0`X(`0`d#\#` #d#h a@#l #p#t#xd #h     ܀`  -    c `Ѐ`       @    D@      cx `(`0`X(`0`d#\#` )#d#h a@#l #p#t#xd #h     `       c `Ѐ`       @    D@      c`h(`0`X(`0`d       '@   @L   'lD @     ``     
   \    ʌ   '` 5   l` 1      @(   #@ (`#@+` @(` @(`@#@@     'lD @     ``     
    @ 0```(` `\@   \`   D      `	``     @ 0```(`@'`(`0`x#@ `'pp`    p`    c ``    $  aXp@ +   p(`@ Ѐ`        t 't| `'|p(`@ @    $?p(`@ !	da   $ p(`@ '<p` =   p` 4   p` +   p` "   p`    p`    p`     ax'8 #    a'8     a'8     a'8     a'8     a'8 
    a'8     a'88< ` V   `	`` P    @ 0```(`@'@ ``   ```   `(`8`\@    `(`8` a\ ܭ      `         @    '@   $  ``      a#`t 't| `'|    @~~   't`    t`      @  ` @   
   |` 1   `-   H @ 'l   @}   `   '`    c `Ѐ`       @    `  )      @}   (`@ |Ș#@ (`#@+` @(` @(`@(`@ |̚#   ka @'\\`     \@~}   D@ '     c c`h   `(`0``(`0`d@ `#\#` #d#h a@#l #p#t#xd h    (`@   @}t   (`@|'|' `'H @ @   l`    `    \    Ȩ   '    \  
   Ȝ   '   @}@   D @     ``        `     `    O   #@ (`#@+` @(` @(`@#@@    'l   #@ (`#@+` @(` @(`@#@@     'l(`0``     `(`0`(`0`@       `7 @ 0```(` `\@w   \`s   D      `	``f    @ 0```(`@'`(`0` c`h(`0`@
Q   `(`0` c`h(`0`#@`D   @ (`0``@<   ``0````     H @ ` .    !b b`@|   %   ````    `d#@ '`  	   @         c ``      bH`d   `(`8` ñ   H @ 'H(` @ ``    HH @  `#@ H(` @ `#`H @ @`3`H   F    `     H #` 	   `     H #`H(` @#`,H @ `   H @ (`@'4HH @ (` @ ``# HH @ (` @  `#@'0',,0@    0',,4#}(   'H @ @    H(` @ ``     H @ @ 0   HH @ (` @H(` @ `# HH @  @ @H @ @`H3 HHH @ (` @H(` @ `,# ,H @ (`@(`@|#<|#<H @ `     H @ (`@'(HH @ (` @HH @ (` @  `#@HH @ (` @HH @ (` @  `#@'$'  $@    $'  ( },H @ (`@'HH @ (` @HH @ (` @ ( `,#@HH @ (` @HH @ (` @ , `(#@''@    '#}H @ (`@H @ (`@H @ (`@< |Ș#@ (`#@+` @(` @(`H @ (`@ |Ԙ H @ (`@ |̂# "H @ (`@ |`     H @ (`@H @ (`@ | `#<HH @  `#@  `'   HD@          HH `H@   @ [   $ H ``     H @ `     ` @  `?'H @  @ ?   (`@ }? }`  	    ` @  `H?(`@ } ?  } `  	    ` @  ` H?  ` @  ` 	?PH @  'P	J? `'    c ``      b@z    ` @  `            `  @  `   	        H #`HH `,0` @# T L    `( @  `            `0 @  `   	        H #`HH `,  d@{     @$ T &    `8 @  `            `@ @  `   	        H #`HH `, #@{b     @$ TH `T`  "   H `T#@ c @     c ``     H `T#@  T a@z     bВ ؓ   H `TH @ `    c `Ѐc   H @         '<<`  `   'H @  @    (`@(`@ }0<@{    $=0 `'   'H @  @ =   H(` @H(` @  `#@'H(` @H(` @  `#@'@    ' `@    H #`H &%b#`D    (`@D }0@'D `'   <`  	   H   `H `D    <  > b @z    `  
   H #`H #`D    < # @y    `  
   H #`H 
#`D    H ``     H @  D @z    '	?`  	    ` @  `𕢈H? `H @  `H? `P @  `聪       葠L'D     `P @  `葢ȑH'DD   @'DD'D'H @  @ 2   (`@D }0#@'(`@ }0D#@'@    '䑠	?䀠`  	    ` @  `ؕH?ؕ	HHJ?H `'   H @  '	H	?HH' `H @  `H?@y      ! `H @  `H? `P @  `ȁ       ȑL `D     `P @  `ȑȑH `D `D   @#`D`D#`DH `D`J    H #`    H #` @    ' b#`"@    '#`'hh (` @(`@ c #@ H'`` <   `(` H`@@    h (` @(`@ `  c@x   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c#@ h (` @(`@ `H  c`@yn       h (` @(`@ `  c @xf       h (` @(`@ `  c(@xW       h (` @(`@ `  c0@xH   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c8#@ h (` @(`@ `  c<@y   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c@#@ h (` @(`@ `H  c`D@x    u   h (` @(`@ `  cH@w   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c8#@ h (` @(`@ `  c<@x   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c@#@ h (` @(`@ `H  c`D@x       h (` @(`@ `  cP@w|   H'``   `(` Gc@@    h (` @(`@h (` @(`@ `# h `'hh (` @(`@ cX#@ h (` @(`@ `  c@wC       h (` @(`@h (` @(`@ `# h `'hh (` @(`@ cX#@ h (` @(`@ `  c`@w       h (` @(`@h (` @(`@ `# h `'hh (` @(`@ cX#@ h (` @(`@ `  ch@v       h (` @(`@h (` @(`@ `# h `'hh (` @(`@ cX#@ h (` @(`@ `  cp@v    X   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ cX#@ h (` @(`@ `  cx@v    ,   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ cX#@ h (` @(`@ `  c@vg   H'``    `(` Gc@@    h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c#@ h (` @(`@ `  `@v.       h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c#@ h (` @(`@ `  c@v       h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c#@ h (` @(`@ `  c@u    a   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c#@ h (` @(`@ `  c@u    5   h (` @(`@h (` @(`@ `# h `'hh (` @(`@ c#@ h (` @(`@ `  c@u~    	   H$ c@ @ "   '`    `     (`@ Ѐ`  w   `    `     m   (`@ @ !   $?А @    ' c`#@  `  cx@uC    `(`@ #`(`@ '` =   ` 4   ` +   ` "   `    `    `     ax' #    a'     a'     a'     a'     a' 
    a'     a' ` `'x   ?'''` ,   (`@ Ѐ`         쀠`     (`@ '    (`@ (`@ # ' `'   `     (`@  `D  @ $    ``     '`     @u6   @   'LL   X  | ,    (   8 x  < `  < p < < <  < < < < < < <  < < < < < < < < < < < < < < < t㿀'D'H /LH ``  S   H `''D `쀣@ V   (`D@ `' @ @ @t2    `  4    ``@t(    `  *    ``@t    `       ``      ``      ``      ``@t    `     '     `'   L``      `X@s    '    L``      `@s    '  㿈'D'HD`     '    D @ H@s    `     D'    D `'DD`        '  㿈'D'HD`     '    D `H@s    `     D `'    D `'DD`        '  P'D'H'L'P'T''D'쀠` x   H @     '耠`     f   '''' `  " @ D   ' `  |@sp    `      '̂ |'     'Ђ &'@s^    '؀`     (@  ܒ`@sE    `  :    @@ (`8``  
   Ѐ`      '     `Ԑ   @sa   '`     @ (`8``      
   Ѐ`      '    Ă `'̀`         @ (`8``< Q    ܂@@ (`8` @s\    `  D    @@ (`8``  
   Ѐ`      '    ܂ `Ԑ   @s   ' `Ԑ   @s   '䀣@    @ (`8``      
   Ѐ`      '    Ă `'̀`  u       @ (`8``> Q    ܂@@ (`8` @s    `  D    @@ (`8``  
   Ѐ`      ' [   ܂ `Ԑ   @r   ' `Ԑ   @r   '䀣@    @ (`8``      
   Ѐ`  *    ' 3   Ă `'̀`      *    `ܒ @rW    `  
   Ѐ`      '    Ă `'̀`         ؀`     ؂ `'؀`        Ā`      ' `'`     T`     L`     LL @ @#  ' $    `' `'   L`     LL @ @#  P`     PP @ @#  @ `?'  h'D'H'L''D`      ` a$ a @k   H`      ` a$ a0@k   L`     DH y   D'쀠`  9   H `    '耠`  )   ''ܘ `       L`     ܀@    ؚ#@ a@  @q   ܂@'؂@' `'   䀣@     ` a% ah@j   䀠`  $   ?`  	    a @  `ЕH?䕠?䀠`  	    a @  `ȕH?ȑ	?     a @  `?Ё ( )  @'D'H'L''?؂ $' bP @  `?'D`      ` a%! a@j`   H`      ` a%" a@jS    bP @  `            bX @  `        ` a%# a@j6   H a'(`L@ @ ` 6   (`L@ @ ''D         !?؁        bX @  `H          ''H a@ a   H(` @ a  @ @ @p    `  N   H(`@ @  `ȁ            ' B   (`H@ a (`H@ a$H a#@(`    @q   (`H@(`H@ `H a#@(`    @qp   HH a #aHH a(`@ bP @  `#@ #`     `'   `      bX @  `H           H a@    H?#a    HH a `#a'Ă?' @ T   Ā` "   H(` @ ` `?H(` @ a$'H(` @ ` `H(` @#a$?' +   H(` @ ` `ȁ   	        H(` @ ` `?H(` @ a$'H(` @#a$H(` @ ` ` ' `'   Ā`    HH a a!$   HH a `#aH a@    H#aH a@    H(` @   b` @  `H? `'   H a`  
   H a`     H?#a  㿈'DD`         D'쀠`      `' ``      `@o   @o   '     'D'' '     5   @     c''   ''`       @'(` @(` @(` @'  
    |H'@ 3      '@o   'D  @     ``     Ȁ`     'XXk('XX@ 
   X<H'XX@        '    c #c c ``     c  @ i    'D@h     c @  `Ȑ$ bh ?  @    D `X`     D'#@ov   '||@     
   '|@on   '%   | `X   !@o2   D ``   @ )    `     D ``   @     `  =   D ``   @     `  2    c b耠`  '    c ``     $ b@ _   Ȁ`     'XXk('XX@ 
   X<H'XX@ {       '   $ b@ @   '`       @nt   D @     ``     Ȁ`     'XXk('XX@ 
   X|H'XX@ H       '   @ R   D `X(` @'x  @ @(` @(` D    x#aD `X(` @ (` @(` @(`  c c @  `Ē  d?      (` @(` @(`@ v`      (` @(` @(`@ v`         `     @n    `'y   D `X't`     `'p     'ppt aD `X a  @ @(` @(`  D  X@m    `  @  `?''D `X a@ P    (` @(` @(`@ v`  >    (` @(` @(`@ v`  1    (` @(` @(`@ t t            (` @(` @(`@ t t?' (` @(` @(`@ v`          `'   'D `X a@ #   @         c ``     D `X(` @ a@ T     cX     `'   D `X a쀠` #   D `X a`     D `X @  ` ` @  `H            c ``  	   D `X ca˪   D `X#aD `X a`     D `XD `X a(` @D c c @  `a Xd?      c `` 1   D@f   'l c  @ X    ' c @  `?` c  @ I    #@' c @  `?#\ $ cl`d@    Ȁ`     'XXk('XX@ 
   X|H'XX@        '     ''\Ȁ`     'XXk('XX@ 
   X<H'XX@       \'@l     `'D'H'L'P'T  @l    ' @l    '/T`     T@ ` T@@ ` T@@ `   ` @l|    ` ` `#\#`L#dP#h#lDH `( `` `h@ld        'D'H'L'P'T `@'d `?'XH`      `'T2   H`      `'T)    `@    
@l   '``H@    `(`D@ @ `      `k   `(`@`(`D@ @ #?x` `'`    `@  
LPTo    `@@l4     d @'d'\'``H@    Xd @`d     ` a&* `@e-   `(`@ x`     H `@ 1   `(`@ |`  )   `(`@ x`(`@ |  `@k    `     `(`@ x`(`@ |  `     4    `      '\`(`@ xXd#@d  @    `(`@ x `@k     d @'dd   (+   `" `(`@ x `'쀠`  ;   Xd#@d   @ b    @ @k     d @'dd   =+   `"  `Xd#@d  @ H    ` @k     d @'dd   %+   `"  `'   ?d@@ (`8``(    d 'dd   )+   `" d   
+   `" `(`@`(`@ x `#?x` `'`    \`        d(@  `@'TT  x'D `@' `@  ( @k_   D`      `'    D @ `  !   D @ @ (`8``     D `@  `@ @j    '`      `%    @'D'쀠`      `@#@  @    @j      @' `@#@g     ` a&b a@c      (+   `"  `'耠`  Z    `@#@   @    @j      @' `@#@g     ` a&g a@c      =+   `"  ` `@#@  @ X   @j      @' `@#@g     ` a&k a@c      %+   `"  `'   ?@@ (`8``(     '   )+   `"    
+   `"  `'W   (@  `@'܁  㿈'D'H'L'P !b@j/   H`      Ha0 @j    `         a8LHM   P @ `     ahLHB   H `'@ (`8``     @ (`8` @j{    `      `'    |@i    '耠`      aLH    '@ (`8` @jX    `      '    `'쀣@     aLH   DP @ (` @#@ ` @ o
   $ DP @ (` @#@  @i   DP @ (` @#@ @(@ '@ (`8``     @ (`8` @j    `      `'    |@i    '耠`      aLHǩ    '@ (`8` @i    `      '    `'쀣@     aLHǈ   DP @ (` @#@ ` @ n   $ DP @ (` @#@  @i   DP @ (` @#@ @(@ '@ (`8``     @ (`8``|     `'   @ (`8``      `'@ (`8``     @ (`8` @i    `     @ (`8``|     `'   @ (`8``|    DP @ (` @ `' Y    b@i    '耠`      aLH    '@ (`8` @iD    `      '    `'쀣@     aLH   DP @ (` @#@ ` @ m   $ DP @ (` @#@  @ht   DP @ (` @#@ @(@ '@ (`8``     @ (`8` @i    `      `'    |@hv    '耠`     '@ (`8``      `'    '@ (`8` @h    `      '    `'쀣@     aLHl   DP @ (` @#@ ` @ m   $ DP @ (` @#@  @g   DP @ (` @#@ @(@ PP @  `#@ DD ` `#`  x'D ' 'D'D'D@ (`8``     '     %@g    '䀠`  
    `' `'    (` @(` @    ''耣@ ^    =@g    '䀠`      bD   (@  (` @(`ܠ@@g    $   `' 쀣@ #    %@g    '䀠`      bD   (@  (` @(`ܘ@ (` @(`܂@ `#  (` @(`܂@ `  @ S    `' `'   '؁  h'D''D@g    'Ԑ @ E   '''ܒ 
@ge    '؀`      @  +  ` @ @ (`8``     @ (`8` @g    `     ܂ `'   @ (`8``      bP`    ܒb @g    `  e   ܂ `'@ (`8``     @ (`8` @g    `      `'    b@h    '`  
   @g     @' '@ (`8` @gj    `        䀣@     bP   #@ ` @ l&   $  #@ `   @f   #@  @(` X    ܒa0 @g:    `      x    E   ܒ (@f    '`  6   (@  ``  
   ̐ @ w   $  `'@f    $  `' (+@  )@f    '`      aī   (@ l   $      bĝ   ' `'܀`     @ (`8``        а   h'D  ''''(` @ '   'D b@f    '䀠`      bDj    " @f3    ` D   ؂ `'(`8``
   (`8``#     c  @g*    `      !b cؖ @fZ       `'@ (`8``     @ (`8` @ft    `     Ђ `'    Вb@f    'Ѐ`  	    bPؔ    ̂ '@ (`8` @fP    `        Ѐ@ 	    bPؔ    ܛ(`@ @    $  ܛ(`@ @ Ђ#@ ` @ j   $  ܛ(`@ @ Ђ#@ `  Д @e|   ܛ(`@ @ К#@  @(`ܛ(`@ @ '#`'Ԃ " @e    `     ؂ `'(`8``#       (`8``
     u     cP @e    `     C     a0 @e    `      ؖ       'Ђ  (@eK    '̀`      !b cؖ @e      (@  ``  
    @    $  `'@ef    $ ̂ `'̂ (+@ В )@e    '̀`      !b cؖ @eT      (@    $ r   ܂ `'@    c`       @eV   ܛ(`@ @    㾐 !  cy         c  `     w       0'D'H'L 'D`     ` a'  ` @]   D`    'k    'D@     @H@(`0``      @H@@ (`0``         ' @@' @H@ @H@  #@(`0` @H@ @H@?@ #@(`0`     @H@ @H@  #@7     @H@ @H@?@ #@70 @H@@ (`0` @H@(`0`      @H@@ (`0`a     @H@(`0`  ?a瀣@         '     `'u   `      '    L`  R    ''D @     @@(`0``    '     `'   `  3   'D @ ,    @@(`0``(`0``      @@ @@  3?     @@ @@ 3? `'   'D @ #    @@(`0`c     ' k    @@(`0``      ' ]    `'    ' ''D @ <    @@(`0``     ' ?   `      @@(`0`i     @@(`0``(`0``     ' @@(`0``	    ' `'   `     '    `     '    '  㿈'D'D@@ (`8``     @dG    ``  m   D@@  '``9    `(` Z`8@@    D@ 4+@     D@ 3+@     D@  `x@d      @c    @,      D@ 0+@     D@`(`8``     D@`(`8` @c    `  	   D@ z+@  e   D@ $+@  ^   D@ s+@  W   D@ S+@  P   D@@ (`8``@ !   D@@ (`8``Z    @c      @cX    `     D@D@@  ` +   (   D@@ (`8```    D@@ (`8``z    @c      @c0    `     D@D@@  +   `'4      e h h h e h h h e h h h h h f  h h h f h h h h h h f h h h h h h h h h h e h h h e h h h h h f  h h h f h h h h h h f'D'H'L @cC   'd'`'\'X'T'P'L'HL`  
    @c6   ?'D]   H(@ D @ `     D ``  	    @c"   'DJ   D ``     D `@     'd   `@c    d@c   d@bF   'd  "@c   D ``     D `@ m    '`   `@b    `@b   `@b'   '`  "@b   D ``     D `@ N    '\   `@b    \@b   \@b   '\  "@b   D ``     D `@ /    'X   `@b    X@b   X@a   'X  "@b   D ``     D `@     'T   `@b    T@b   T@a   'T  "@b   D ``     D `@     'P   `@bv    P@bq   P@a   'P  "@bk   D ``  %   D `@     'HH@     'L   `@bR    L@bM   H@a   'HL@a   'L  "@bC    c c4`     D ``    hDDD    `` @`       /h @b'   '@D @ '<D @ `       a('<D ` `      a0'8      a@'8D ``       aH'4      aP'44#\D `#`h#dHL  aX<@8@`    @a   'D    '00 @a   '00@`   D  0'''܂     '쀠`  	   $  a@ H      'Ԃ 'Ђ '̂ 'Ȃ 'Ă ' @a   ' `  @ k       '@`   '@`   'ܒ  Ԗ    a @ ?   ܒ  Ж    a @ 6   ܒ  ̖    a @ -   ܒ  Ȗ    aȚ @ $   ܒ  Ė    aК @    ܒ      aؚ @    '쀣@   ؘ `؂ (` @(` @(`@ `ܒ Ԗ   ?@    ؘ `؂ (` @(` @(`@ܒ   a @ q   ؂ (` @(` @(`@ `  ! @ O    ؖ `؂ (` @(` @(`@a (`0`ܒ   a@ M   ؂ (` @(` @(`@ a$`  `   ؂ `ܒ Ȗ    a?@ ©   ؘ `؂ (` @(` @(`@a)`؂ (` @(` @(`@a*`؂ (` @(` @(`@a+`#\؂ (` @(` @(`@a,`#`؂ (` @(` @(`@a-`#d؂ (` @(` @(`@a.`#hܒ   b   @     A   ؂ (` @(` @(`@ a$`    ؂ `ܒ Ȗ    b ?@ >    '   ؂ (` @(` @(`@ a$`    ؂ `ܒ Ȗ    b0?@ $       ؂ `ܒ Ȗ    b@?@    ؂ `'؂ (` @(` @(`@a(``       bH'      bP'Ė  ?@    ؂ `'   $  bX@    ܒ  @     $  b @    @    '`     @    @_    Z    '耠`  	   $  b@        'Ȃ '̂ 'А @_c   ' `  @        '@_W   '@_    'ܒ  Ȗ    b @    ܒ  ̖    a @    ܒ  Ж    bȚ @    '耣@ j   ؛(`@ `'   @L   (`0``       b  b!5  c @W   ؛(`@ `''ԂԐ @^    ؚ `(`0`ܒ   a @    ؘ `؛(`@ @  `ܒ ̖   ?@ >   ؛(`@ ``     ؛(`@ `'ԂԐ @^    ؂ `ܒ Ж  ?@ !   ؂ `'   $  c@ 
   ܒ  @     $  b @ 
   @    '`     @    @^        㿀'D'H'L'PL'P'P`      x   D ` `    耠`     k     cP@^&    `' 'D @ `  5   D ` ` 	   D ``     )    c b`     H`    D ``    D  cX @ @]    '    D  c` @ @]    '      c`  a(@]    '耣@    䀠`     @'#@'耠`         (@     L(@    'D'H' '?b$ @?b ? @?b? @?b? @?b? @?b @H@ }U    ?b @?a @ @e7   ?a @?a @  @eK       ?aȂ @ @ ?Ȗ ?a @ @e*   ?!Ș #  ?aȚ@@ @]   ?a @ @e      ch@ 	   ?a @?aH @@ |=    ?a @ @`  (   ?a @n   ?aĂ @ @ ?aH @@ y       cp?Ė  @ 	   ?a?a @ @   H?b@  @@    ?b @D $@ A   ?! #  ?b @` 
     c?a@#@       c?! #  ?b?Ḗ" ?b @` 
     c?a@#@       c?! #  ?b @` 
     c?ᰖ"       c?a@#@ ?!   #\$  c?a@@ ?!    @?a@@ ?a @ @ @ 	7   H@ |D    `    H  @ {     nD    $ @ 	#    I   ?a @?aH @@ {u    ?a @ @`  4   ?a @`     $  c@ 	    ?a @n   ?ᬖ" ?aH @@ x    $  c?!    @    ?a?a @ @   $  c@    D@U    D@U      !`   @      !` @    ?a @ @d	      ?b @D $@ T   ?a@#@  c c(`  
    !`0?ᤖ"       c?a@#@ $ !`@?!   ?a@@ @    D@U    D@Ux      !`X  @ {   ?a @?aH @@ z    ?a @ @`  Y   ?a @`  	   $ !`h@ Z       $ !`x@ S   ?aH @@ x   ?a @ @ ?a @m^   ?᜖"  c c(`  
    !`0?! #        c?ᘖ" $ !`?a@@ ?a @ @ ?a@@ @    ?a?a @ @   ?a @`     $  c@    ?b @?b ?b @@   `#@  @?b?b @@   `#@  @?b?b @@   `#@  @ c b`  
    c c4`         ?b?b @@   `#@  @?bH?b@  @#@ @?b @`       b  b! !`@T.   ?b?b @ ` @?b$?ᔖ"  @[b   ?a@#@ ?b?b?a @ @  @ @@        ?Ȗ" ?!Ș   ?a@@ @[C   ?aȂ @ @ <   ?ᐖ ?ᔖ  @ c c(`     ?b$?b  @   @   !` @ r       ?b$?b  @   @   !` @ a   ?b$?b @   @   !` @ R   ?b$?b @   @   !` @ C   ?b @`     ?b$?b @   @   !`Ț @ -    c c(`  
    !`?a@#@      !`?! #    !`?a @ @ @    ?b  @ c c(`     'H    @ v    '`    H `@ y    ``    `  	     !`x@        ' `k    '@ (`0` @ d    '(?ሖ" `  
    @ ?a@#@       a(?! #  ?a @ @  @ !`?!   @Y   ?b$?b?b @ (`0` @ @ @ !` @ &   ?b$?b?b @ @ @ ?@    ?b$?b?b( @ @ @  ?@ w   @ (`0`?a@#@ `  
    @ ?!| #        a@?|"   !a ?a@@ ?a| @ @ @ *   @ (`0`  !a @    `      @ `      @ @ (`8``  	     !aH@ @      !ax@    ?b?b @ ` @   'H!   @ u    '`    H `@ x    ``    `  	     !`x@        '?x" ``` 
    !a?at@#@      !a?!t #  ?ax @ @ ?t @Y   (@ (`0`  @ !a  @X    `j    '?b( @ @ n   ?b( @ ``     ?a @ @a    `    ?a @?b( @ `  @a&    c c4` 2   ?b( @ `?!h #  ?ah @ @ ` +   ?h     ?!h             ?ah@@ ` +   ?ah @ @ `        /h   a@@X         !a@X   h  !a@X       /h  !a@X       ?b( @ `@ e)    'h?p" ?al@#@ `       a@?l" ?b( @?b( @?b( @ `#\?ap@@  @ !a?al @ @  @X5   `     ?b( @?b( @?b( @  @ !a `@X    ;   ?b( @?b( @  `@    ?b( @  @ !a`@W       ?b( @?b( @  @ !b `@W       ?b( @ !b`    ?d" ?b( @?`" ?b( @`     (`8``  
     a@?a`@#@       a(?!` #  ?b( @`  
    !b(?\"       a@?a\@#@ ?!d    @ !b0?a` @ @ ?a\ @ @ @W       ?b( @ `  @`   /h?b$?b?b ( @ @ @  ?@ E   ?b$?b?b @ @ @  ?@ 4   ?b$?b?b @ @ @  ?@ "   ?bL@(`8``     ?b$?b?b?b( @ `$ @ @ @
  ?@    (?b( @ `$  ! @    (' /@P    '䀠`  
    |+@  `'    ``     /     ` @@    ' /@Ph    '䀠`  
    |+@  `'   ?b( @`     /    ' /@PJ    '䀠`  
    |+@  `'   @ (`0`#\h#`(#d  !b8  @ j   @ (`0`  !bP  @ ^     !bx@ X    ``      `@ (`8``  	     !b`@ D   ?b( @(  * g    `     ((`8``  	   (   c` @ )     !ax@ $   ?b?b @ ` @%   ?aH @@ r    `     ?a @h$   ?X" ?aH @@ r      !b?!X    @      !` @    ?b$ @  @     $  c` @    ?b$ @?T" ?aT@@ `     ?aT @ @ @    ?T @V   ?a @ @^>    `     ?a?!P #  ?a @ @^-   ?P  @?a?!L #  ?a܂ @` 
    !b?H"       a@?aH@#@ ?a܂ @` 
    !b?!D #        a@?D" $ !bȂ?aL@@  @?aH @ @ ?aD@@ @ c   '?a @  "   ?a܂ @`    $ !c@ N   ?a @ @^A    $  b@ @ ?    `'   @        ?aȂ @ @ ?Ȗ ?a @ @]v   ?!Ș #  ?aȚ@@ @U   ?a @ @]e        p'D//D@U    '  @ @ @ ` @U    '  @ @ @@ `''/D@ /(`8``  d    'Ԃ`` .   Ԃ`(` gb@@     !c' *    !c' %    !c'      !c'     !c'    (`8``-     !c'      +   `"  "    @`      b  b" "` @N&   #@ ؔ @    @U      @'D `'D   (@ @T     ` @U   '    H    4 \      p                  p'D'H'L  @'/'' c `` 
    c ``        (`' `@ @ `      `@@ :   $  D  @     'D /D'Ԁ` 6   Ԁ` 	   Ԃ`     +   Ԁd     Ԁd     Ԁ`        Ԁh          c cdHL@U        !b@TV    !bHL@Uy       D''؂````  
   ܂ `'؃8`'   ܀`      b  b" "` @M[    c܃(` @ cT`  k    `@ @ HL@U    '`      [   `      !b "`8 "`@TZ    @S   쀣@     !b "`p "`D@TG    @S   D`    ``      `@ @     `@ c܃(` @    cT@U   '䀠`     !b "aD@T    @S    !b "ahD@T    @S        x'DD@S     ` @ X   ''D'''@ (`8``  8   ܀g 4    "a @T    `      `'   @ (`8``&    ' 
   @ (`8``;    '   @  `#   (@ `" ܂ `'   `     (@     (@    㿈'L'P'T'X'D'HD`       b  b# "b @Lv   H`  $   H@ (`8``          '  @    D@`  	   L'Ht    @'     㿈'DD`  *   D` &   'D`  !    c(` @ cT`     D```  
    c(` @ cT@Sk   D8`'D `'     㿈'DD0`
```  
    c cd@R   D | 'DD0````  	    !b@R   D x 'DD0````      "b   D`  +   D` '   'D`  "    c(` @ cT`     D````  
    c(` @ cT@R   D8`'D `'     㿈'쀠`     c(` @ cT`  
    c(` @ cT@R    `'    !b@Ry    !b@Ru        㿈'D'H'L'D`     D`        ?'    D````  
    `'D8`'D    c(` @ cT`      `4(` "bH r   L@ (`8``- *    L@@ (`8``  !    c(` @ !b#cT c "bp "b@Ri   $#d c cd`  ;    "b "bpE    3    c cP`      c(` @L "b@RJ   $#T     c(` @L "b@R=   $#T c(` @ cT`      `4(` "b L    '  'D'H'L?'?''L@ `   L@     @H@@ (`0`'\     `'\\' `@ ?   /`耣@    䀠 	   `  "b@R    `ހ@    䀠    `  "b@Q   `` @Q       "c @R   `(`8``  	   `D  c`    '' `'     㿀'D'H'L'PD `'D `'D `'  "c   쀠`     D  @ v     "c(   耠`     D  `f     "c8   䀠`     D  `V     "cH           㿐'D'H'L'P  "cPDHP    LP:     "c        㿐'D c c8`     DD "c !a@      c c`     DD "c !a@      c c`     DD "c !a@      c c`     DD "c !a@      c c0`     DD "c !a@      c cD`     DD "c !a@      c c@`     DD "c !a@  v    c c,`     DD "c !a@  f    c c `     DD "c !a@  V    c c<`     DD !a !a` F    c c(`     DD "c "c` 6           'DD@     ''D쀠`  O   @     '@@ ` @@ ` @@ ` @@ `#\ @@ `#` @@ `#d     b   @P   @`     @    'DH   "cD@O   D@Pb       /HȘH  #`           㿈'D'HD@I   ' c@K	    `     #`('     #`0'  #`8H{   D   D@Ij    @ (`8``     D@I`      #`x d         HbH@O    `       #`T           㺸'D'H c c`  %   @D $@     $ #`Ȕ 9   D@I^    D@I'      #`  *   D  a(   W   D ``  y   D ````       bH'<      bP'<D<s   D  #a `   D@I)    D@H    D  #a        c c`  %   @D $@    '8D'4D ````      #aP'0      a@'0$ #ax84 `0       @D $@ i   ',D'(D ````      #a'$     #b '$$ #b,( `$        c c`  w   D ````       bH'       bP' D    D ````      @D $@ &    $ #b` z   D@H    D@Hh      #b  k        c ``     H`         H`     @D $@ ~    $ #b L       @D $@ ~    $  #b =   D@Hb    D@H+      #b  .    `   D ````       bH'      bP'D    c ``  G   D ````     @D $@ ~    $  #b     1   H`     @D $@ ~    $ #c        @D $@ ~    $  #c    D@H    D@G      #b          㿈'D'H'L'P'H @ 쀣@    (`D@ @ P@N    `     H @ '      `'   H @ L@    ?'    H @ (`D@P#@ HH @  `#@ H @ '  x'D /H''''耠`      @ @(`@(z(`@ $` @  `#{#{ `'   D a` O   'D a쀣@ Y   D(`@ ``     D(`@ $  #c8`@M       /D(`@ `/    'D(`@ @ &    'D(`@ `    'D(` @ ` ` $`  @  `HH#\  #cH    @M   @M   @M    `'   'D a쀣@=   H``     D(` @ ` ` $`( @  `   	*   D(` @D ` ` $`0 @  ```
      D(` @ ` ` $`( @  `   	        쀠`	   D(`@    `         'D(`@D(`@   `@M    `     D(`@  `$ @        D(`@D(`@ $  #c  `@L   '@ |   (`@  @L    `  j   D(`@ ``  g      @ @(` D(`@  `@H&    `  T      @ @(`  @L    'D(`@ `@L     @ ``/     #c     @ @(`@z(`8``        @ @(`   #c@L      @ @(` D(`@ 0#@   @L        `'   @ ;   `     ' 8   (`@   @ "   D(`@ ``        @ @(` D(`@  ` 0@ 
   (`@D(` @ ` `#;#; `' `'   `     `     $ #c   '@ "   (`@' 쀣@     #c'      a@'$ #c     `'    $`( @  `   	         #c'      a@'$ #cy   '@ X   䀠`     $ !`xj   (`@$  c` `     @ @(`@z(`8``        @ @(` $ $` F   (`@ { { $`( @  `   	        (`@ { { $`  @  `HH'$ $` "    `'   $  c           H'DD@ }    '쀠`  A   @     'Ę@ ` @@ ` @@ ` @@ `#\ @@ `#` @@ `#d     b   @K+   ''Ā`      $`8'$ $`@        'DD `\` K   D `X` F     $`X   D `X a`  
   D `X  $``a   D `X a`  
   D `X  $`a   D `X@ }   'T'P c b쀠`     D `X@ }    ``      'PTP   D `X a`    D `X a` 
    c ``        D `X a`     D `X a   $`@ [   D `X a  @ D    'D `X a   $``I   @J    'D `X(`@ @  ` %a @  `H        .   D `X(` @ a   $a@ '   D `X(` @ a  @     'D `X(` @ a   $``   @J    `'   D `X a`    D `X a $ $a@       D `X a $ $a@     'D `X(`@ @  ` %a @  `H          D `X(` @ a $ $a @     `'    c b쀠`     D `X@ }     ``     D `X a`     D `X a D `X @  ` %a @  `HH'$ $a(       '쀠`	 k   D `X a쀣@ d   D `X(`@D `X @  ` %a @  `@ `
        N   D `X(` @ a D `X(`@ @  ` %a @  `HH'$ $aP   _   D `X(` @ a  @ E    'D `X(`@ @  ` %a @  `HH'D `X(` @ a   $a` `7   @I    `'   $  c*   D `X@ |    ``      D@ {    D `X aD `XD `XD `X a a       ` $a     *     ` $b(    c ``    D@ {    D `X aD `XD `XD `X a a       ` $bh    $  c   D `X a`      c ``  
    c ``        D `X a`     D `XD `X a(` @ a    $ $b        D `X a P    c `Ѐa ,   D `X a`  &   D `X a`      D@ {$    D `X aD `XD `XD `X a a n      ` $b u    k   D@ {    D `X aD `XD `XD `X a a P      ` $c( W    M   D `X a    D `X a` 8    c ``  2   $ $cx>    c ``  
    c ``      (   D@ z    D `X aD `XD `XD `X a a     $ $c          b  b%! $c@A    c ``  
    c ``         D@ z    D `X aD `XD `XD `X a a       $c      %`   D `T`  8   X   @H   D `T @H    `   @H7   ` c   DX `T#@' %a @  `Ț`$ %`?    DX `T#@`  %`0     D @ ` g   ''D @ 쀣@ 3   #@a     %`X   䀣@ 	      ,+   `" D(` @ %``@H   @ (`8``      `'    `'   D `X$    D `DW    D  %``D  N    c ``     DW    $  c` >   D  %``D7   D @ `    ''D @ 쀣@ 6   #@a     %`   䀣@ 	      ,+   `" D @ @`H(`0` %a8 @Hm   @ (`8``      `'    `'   D `X      %a@      c ``     D `W    $ %ap    D `W      %a    ''D @ 쀣@ 3   #@a     %`XI   䀣@ 	      ,+   `" D(` @ %``,@H
   @ (`8``      `'    `'   D `W      %a    D `` 	     %a {     %av   9        㿈'D'HDH@    '`  @  '   ('D'' '''$$`    $(`@$(`@$(`@(w+8*($ `'$   D `` !  @ c    '쀠`     ( @ \C   <`  H   D@@     <    `  <   '$$` 7   $(`@z((`8``     $(`@ <    `         $(`@z((`8``       `' $(`@ <! @F\       $ `'$   @`  <   '$$` 7   $(`@x(`8``     $(`@ @@F"    `         $(`@x(`8``      `'$(`@ @ @@F       $ `'$   D` c   '$$`^   $(`@w(`8``     $(`@ D@E    `     F   $(`@w(`8``      `'$(`@ D @@E   .   $ `'$    `     `     `         $ %aU    !b(' `  9    `      a@'     !b'$ %b 9    '$$`    $(`@z((`8``     $(`@$ $a     $ `'$    %b'`  9   `      a@'     !b'ؐ$ %b      '$$`    $(`@x(`8``     $(`@$ $a     $ `'$    %b'`  9   `      a@'     !b'$ %b0     '$$`    $(`@w(`8``     $(`@$ $a     $ `'$    %b'$  c   _        p   @D    c @ f+    ' %b @  `ȑH' c cV     %@E      <@Ey      @Ew      <@Eq     c cc c#@ c c#\ c c#`#d$  %b@  L        `   @D     @D    ' c c`      !b %b@D    c c`     c c`      c c`      c c `    $  %b   ` c @ e    ' &` @  `? c' c c`     %c0'     %c@' c' c c`     %cP'     %cX'#\#`$ %c`c c    c ``      c @ `      c@ f    ``       }    $ %c     @Dx    h   @    h F   h c c cc c#@ c c#\  %c    ` c @ e)    ' &` @  `?h' c' c c`     %c0'     %c@' c' c c`     %cP'     %cX'#\;`  &` c cL   ` c @ d    ' &` @  `?h' c' c c`     %c0'     %c@' c' c c`     %cP'     %cX'#\;`  &`` c c	     &`           㿈'DD` '   D(` yaX@@     &`' %    &`'      &`'     &`'     &a '     &a'     &a &`D]    &a('        h'D'H'LD@ `'Ȁ`    Ȁ`    Ȁ`        Ȁ`    Ȁ`        D```     А  &a0  @        'D``0````  	      S+   `" D`````  	      F+   `" D``0````  	      R+   `" D``0````  	      P+   `" D``0````  	      A+   `" D``0````  	      U+   `" D``0````  	      E+   `" D`(`8``  	      C+   `"  @  +  ` @ D`(`0`HL &a8 @BQ    '   D`(`0`HL &aX @BD       D``HL &ah @B8       HL &a@B0        &axj   H   㿐'DD?'@   㿐'DD?'@   㿐'DD @ `     D @ @B   D?#@   㿐'DD @ `     D @ @B   D?#@   㿐'DD @ D(`D(`D(`D(`D(`D `    @B4   D `    @B-        㿐'DD @ D(`D(`D(`D(`D(`D `    @B   D `    @B        㿈'DD @ `    D ` '쀠`        @B'        㿈'DD @ `    D ` '쀠`        @B        㿐'D'H'LD '@ D /`  㿀'D'H'L'PH'''D #@  @ <  @  @     &a &a   L`     &a &b" &b@:   `(`8`L@     &a &b" &b(@:   D`3` `	`` )    @ 0```(` `L@     &a &b" &bP@:b    @ 0```(`@'D@ 3`$D `#`( )   `	`` #    @ 0```(` `L@     &a &b" &b@:5    @ 0```(`@'D@ 3`$ D@P@ 3  `3 `3   㿈'DD```    D `('    D``      &b &b 	   '  㿐'D 7HD #@ D @A8        $` D +`D +`DH3`D +`  㿈'DD?#@ D aD' c `' c ``          ` 
      ''     '#aD `    @@   D `    @@   D a    @@        㿈'DD?#@ D aD' c `' c ``     s     ` 
   l   ''     '#aD `    @@   D `    @@   D a    @@}        㿐'D  㿐'D  㿈'D'HH`      &a &b" &b@9I    D@H0`(`H`0@````  K    D@H0` (` D@ (`H` (@@"	 D@H0` (` D@ (`H` (@@"	!D@H0` (`!D@ (`H` (@@"	DD a `#aD @ H@ 
   DH#@     '     '  㿈'D'HH`      &a &b" &b@8    D@H0`(`H`0@```  ^    D@H0` (` D@ (`H` (@8 @"	 D@H0` (` D@ (`H` (@8 @"	!D@H0` (`!D@ (`H` (@8 @"	D a`      &a &b" &b@8   DD a #aD @ H@    DD @  #@     '     '  x'D'HD `   ! @?t   D   @?o   DH#aD a@N    D aD a `D a `     @    D a( @ ?   D a`	``  "   D' c@9    `c     c@9   '(` @(` @(`'      ab' a0D aDD a@NX   $!4D a```  
   DD a `l `#a8 5   D a```  
   DD a `l `#a8 &   D a```  
   DD a `l `#a8    D a`	``     D #a8     &a &b# &b@7   D a @ `    D'!@?   '       '@>   '@>   #aP    D aPDD aH#a<D a@   @>T   D aL  x'D'HD `   ! @>   D   @>   DH#aD a@M    D aD a `D a `     @    D a( @ >   D a`	``  "   D' c@8    `c     c@8   '(` @(` @(`'      ab' a0D aDD a@M   $!4D a```  
   DD a `l `#a8 5   D a```  
   DD a `l `#a8 &   D a```  
   DD a `l `#a8    D a`	``     D #a8     &a &b# &b@6   D a @ `    D'!@>9   'Q       '@>1   '@=   #aP    D aPDD aH#a<D a@   @=   D aL  㿈'DD aP'쀠`     h   @>	        㿈'DD aP'쀠`     V   @=        㿀'DD a @ `    D aPD aPa a@    '    D a `D a `a< aH#@'쀠`  Z   D a @ ` 	       ``  M   D a( &c  @  `H &c @  ` &c @  `           D a( &c  @  `H &c @  `ȑH'     2''D aD `a@#  (` @(` @(`D aD `aD#  #@=     耣@    ' +   쀠`1    ' $   D a@Lr    `     '    DD a &c @  `Haa
            '    '  㿈'DD` &    D(@'b`       ap@`       @`          '     '     '     &c    '  㿀'D'H'L @Mh   D `  @Mq       ' @Ma   '@<    @MY    @M   D `   @M       ' @M~   '     @Mw    @Mk   D `0  @Mt       ' @Md   '     @M]    @M   D `<  @M       ' @M}   '     @Mv   DH#@ DL#`D `D(`D `D ` hD@ tD@ `D@D  `@@ #  `#  `D@@ " `" tD@@ " `"D `pD `|    @<I   D `D +`D `D +`D `D `D `D `HD ` `D ` `      @    D `,D `    @<!    D@D  `@@ #  `# D c `#`D `D(` D@D  `@@ #  `#  "   'D `< @M   'D `0 @L   'D `  @L   'D ` @K"   '@;        㿀'D'H'L @LY   D `  @Lb       ' @LR   '@;    @LJ    @Lv   D `   @L       ' @Lo   '     @Lh    @L\   D `0  @Le       ' @LU   '     @LN    @Lu   D `<  @L~       ' @Ln   '     @Lg   DH#@ DL#`D `D(`D `D ` hD@ tD@ `D@D  `@@ #  `#  `D@@ " `" tD@@ " `"D `pD `|    @;:   D `D +`D `D +`D `D `D `D `HD ` `D ` `      @ {   D `,D `    @;    D@D  `@@ #  `# D c `#`D `D(` D@D  `@@ #  `#  "   'D `< @K   'D `0 @K   'D `  @K   'D ` @J   '@:        x'D @K    @K   D `#@ @K      'D `#@ @K        @K    ``  !   '#@   @K      '܂D @    '   'D `< @K   ' 
   D `< @K       'D `0 @KP   ' 
   D `0 @KH       'D `  @K?   ' 
   D `  @K7       'D ` @I   '@:Q   D ` @I        x'D @Kh    @Kd   D `#@ @Kc      'D `#@ @Kd        @Kg    ``  !   '#@   @Kf      '܂D @ /   '   'D `< @K   ' 
   D `< @K
       'D `0 @J   ' 
   D `0 @J       'D `  @J   ' 
   D `  @J       'D ` @I   '@9   D ` @I        㿈'DD @  `耠`     D @  `'    D ` ` a(`  	   D ` ` a0'    D @  `'  㿈'DD ` @ ` 	   D    '     D     (` @ @ &%b@    D   '(` @ @'     &%b''  0'D'HА @J   DD ` `@  @ j    ``     D@ L    ``         H`     HD  `@@ #  `# '9   D```  ?   DD `` `#@ (` @(` @(`DD `` `#@ #@9     'Ԁ`     H`     HD  `@@ #  `#  '   H`  
   H D@@ #  `# '   D ``  ]   D `D ``t#  (` @(` @(`D `D ``x#  #@9T     'D `Ԁ@ >   H`  7   HDD ` #@9    `t @$  HDD ` #@8     (` @(` @(``x @$ HHH ` А b@@9        @$@ HH ` А b@@9    $ '   D @    D `? ``  	    &c` @  `H? &ch @  `H؁
        )   D@ $    `     D ``     D `0 @I    ``     H`     HD  `@@ #  `#  'N   H`     'G   D ` ` `
'D ` `' А b@@8     @' А b@@8    'D `#@ @I]      'D `#@ @I^      А  @Ia    ``  o   А @I     @ ```  Z   А @I     @ DC     А b@@8      @'ȂА @Io     @ D0     #@8     #@8     (` @(` @(`  @' А b@@8G    Ȃ @' А b@@8@    '#@ (`#@+` @(` @(`̚@Ă#@`     ''ĚЂ#@   @H         D ``     DD ` #@8o     t @'DD ` #@7     (` @(` @(` x @' А b@@7     @' А b@@7    'D ` `#@ (` @(` @(`D ` `#@ #@7     `  
   D  `@@ '`'#@ (` @(` @(`#@ #@7     '`     '' +   D @ t   `  "   D `? ``  	    &c` @  `H? &ch @  `H؁
           ''H @  `'  `'D'Hܐ @H*    /H`      &a &b# &cp@/       @6       @6   D `#@ @H      'D `#@ @H      Ђܐ  @H    ``  m   ܐ @H>     @ ```  X   ܐ @H3     @ D     А b@@7      @'ܐ @H      @ D     А b@@6      @' А b@@7     @' А b@@6    'ۂ``     #@ (`#@+` @(` @(`@#@`         ''/ۚ܂#@   @G         H'ۂ``     D ` `'    '@ #@ `#`ۂ``     '     '   p'D'H'L @GZ   ' /'D `    D ` `'     ''D ` `X@    H`     H +@ D ` `X'D(`    H`     H(@ D```  l   D ``  g   D@     `  `   D `#@ @G      'D `#@ @G      ؂  @G    ``  <    @GH     @ '```          &a &b$. &cx@.   ```     @D    ``     ``@    /    #@   @F         ``     D(`L`     LD`(@    㿀'D @E   D ``  @E       ' @E   '@5q    @E   D ` @E       'D `` @D   '@5[        㿀'D @E   D ``  @E       ' @E|   '@5?    @Et   D ` @E       'D `` @D   '@5)        㿀'DD `` @F    ``     D `` @F     @ '쀠`        @5;   D `` @F      D `'耠`     &   @5'   D `h'䀠`     @ 7   @5   D `p`  	   D `p@5G   D?#`pD `t`     D `t@    D `tD `x`     D `x    'D `` @D   '@4   D `` @D        㿀'DD `` @F*    ``     D `` @F+     @ '쀠`     R   @4   D `` @F)      D `'耠`        @4   D `h'䀠`     @ 71   @4   D `p`  	   D `p@4   D?#`pD `t`     D `t@ }   D `tD `x`     D `x    'D `` @C   '@4J   D `` @C        x'DD `` @E    ``     ' 6   D ` @E     @ 'D `#@   @E      D ``#@ @E      D `  @E    ``      D@D ``#@ @E      $  '܁  `'DD   H@3   D' c `'耣      ' @ D' c `' c ``     !,'# D cD `` 
@E   $ DD `#`D #`D #`D 2#`D #`D c@#` D &c @  `#`(#`,D' c `` 	    &c @  `?     &c @  `? `0 `4D' c `` 	    &c @  `?     &c @  `? `8 `<D c@-   $ @  `'D'H'L'P''D `   @3   D ` l   'H@/    쀣@ @   H@/     @ D `  @ d    ``      `' %   H@/     @  @3n   'ܒ D`       '@3d   '@3-   'D ``  @Ez    `'   DH@/U   $ DL#`l D@D ``#@ @D      $  D@    $ |DP#@ D'D @ C     $@3)   'В @ 5x       '@3    '@2    `hDDDDDD(`
+`+ ***`D(`	D'@ ` -   @ (` b@@    D +`
D +`    D +`
D +`    D +`
D +`    D +`    D +`D +`	D'Ȑ!X@2   'D       '@2   '@2   #`D `D ` aL@#!LD `tD?#`pD `xD```     D```     D```  
   D`	``      b   D @ ` ]   D`	``      c ```  7   H  @.     @  @9!    `  *   DH  @.     @  @,     s   $ xD `x`     H  @.     @  @+     &c    D?#`p    D   @2f   $ p p`      &cd   D `p4   D `pi   D `x   (T (T ' ' ' ' ' ' ' ' (T ' ( (( (<`'D'H    ?ܐ @BS   ////D `#    /ۂ``  s   H`     D ` `'D `' А b@@26     @' А b@@2/    'D ``#@ @C      'D ``#@ @Cl      Ђܐ  @D    ``  2   ܐ @CE     @       ``     #@ (`#@+` @(` @(`@#@`     ''܂#@   @C$         H @  ` y   D ``#@ @C9      'D ``#@ @C      Ăܐ  @C    ``  L   ܐ @B     @       /ۂ``     ق``     '' /ڂ / +   ؂``     #@ (`#@+` @(` @(`@#@`         '' /ؚ܂#@   @B         ؂``          &a &b% &c@)   D `#@ (` @(` @(`D `#@ #@1M     `  	    D@@ '`'H`     H @  `D `#@'(` @(` @(`D `#@ #@1#     '`  `?'   x'D'H @A   H'@ (`0``     &c   D ``#@ @Bf      'D ``#@ @BE        @B    ``  &    @B     @  @  @ _     @ `      @B     @ '    #@   @B	         '؁  0'D @@    @@   ''/D ``#@ @B      'D ``#@ @A      Ԃ  @B    `` "   '#@   @A       @A     @ 'D `@  @ aZ    /@     ``  	   ߂``         D `  @A    ``  5   D `` @@]    ` ,   D `#@   @A      D ``#@ @A      D `  @A    ``      D@D ``#@ @A      $   c ``     D ` a8`2 |   D `` @@     'Ѐ`  L   ߂``  G   D @ @   ' @ @)$   'DD `h` @ #@ (` @(` @(`DD `h` `#@ #@/     ' '` @  `?#\Ѐ`     '`0'     '`@'#`$  '`P    &   ߂``  !    @ @(   'D @ @C   'Ѐ`     '`0'     '`@'$  '`ۜ   D ``'ĚĂ#@  @A       `'߂``  	   D `D ` aL `#aLD` @  @ `#   '`        @/?   '      㿈'D'H 
' c@ Qh    ``      2' @    c@ Q"    ``  7   H ``     H$  `@/K    `        $ 'H ``     H `@/9    '     ''H `c    D`  
    c ``     ' c@)K     c@)8      @@    '   㿀'D'H'L'P'TD'H`     P `?    P `? @  `DP `#`D `T`      D@T@ #  `#     D `   @.        㿈'D'H'LL`      &a &b%w '`@'A   D```  v   HD `l` `@    ?'    L +@ L +`LD `lH `   @  `" @ 2`D @ `    L +` I    c `Ԁ 	   L c `+` <   D'@ ` ,   @ (` aH@@    L +` (   L +` #   L )+`    L(`    L +`    L +`    L +`     &a &b% &b@&   ' s   D```  %   HD `l` `@    ?' a   L +@ L +`LD `lH `   @ `" @ 2`' J   D```  "   HD `l` `@    ?' 8   L +@ LD `lH `   @ @ *``" ' $   D`	``     H```     ?'    L +@ H +`'     &a &b% &b@&V      ;H ;H : : ; : ;H ;H : ;4 ;H ; 㿈'DD ````     DD ` `l` `@    ' c   D ` `lD ``# ' Y   D ````     DD ` `l` `@    ' F   D ` `lD ``# ' <   D ````     DD ` `l` `@    ' )   D ` `lD ``# '    D ``	``     D```     '     '     &a &b% &b@%     㿀'D'HH@>S     @ 'D ` @?^    ``      &a &b% '`@%   ```  .   D ``      &a &b% '`@%   DD ` #`D ` ` a`      &a &b% '`@%   D ` `D ` ` a #a@;    ``  !   ```     ```     D ``      &a &b% 'a@%^   DD ` #` @ `    @;     @ `     @;    D ` ` aP@ [   D `H@ '#@  @>      '`     R   @,q        'D'H'L'PL@;|    ``     D `4'     ''P`     L `H @  ` P @ ,   L `D ` a( P @ ,    `H@P@ #  `# HH `T `#`TD `D ` a `#aL```     P`      c ``    L@;/    ``      'a8'     &a('H @ @%_     'a@̔ @+   LH ``X#  (`#@+` @(` @(`L `@H `\#@`  O   HD `#`H#`LH'H `? ``  	    'a @  `H?D `P `T	 'a @  `           H `? ``  	    'a @  `H?D `P `TȑH'     '# P XH@ D@@ #  `# LD `` a #@ (`#@+` @(` @(`L `@D ` a$#@`     D `'D `D `D a a`@`Dȁ
           D `?    D `D a a`@`D? a aD `'D ` aD `H `L 'a @  `           D ` aD `H `LȑH'     '#aD!  `@ D@@ #  `#     HH `P`H`L
           HHD `(@+L    '`H`LJ$ H$ L    HHD `,@+:    '	H `H `L H LJ$`H$`LHD `$`H`L
           HD `$#`H#`LD `D ` aaa
           D `D `D `(@+    '!!J$a$a    D `D `D `,@*    'D ` a aaaJ$!$!D `D `$aa
        	   D `D `$#a#aP`     LH ``#  (`#@+` @(` @(`L `@H `#@`      L```  !   LH ``#  (`#@+` @(` @(`L `@H `#@`      	   HH ` `#`    P`     HH ` `#`H `'H `' c `` 	    'a @  `?     'a @  `??䀠`
 [   䕠?䀠`  	    'a @  `H?䕠?䀠`  	    'a @  `H?蕠?x耠`  	    'a @  `xH?xxL	؁        %   H `'H@     c ``     H `Ԁ@    H @ @#@    H@ 'ax @)a        㿈'D  @;     @ '```      &a &b&6 'b @"x   ```      &a &b&7 'b@"i    +`D ``      &a &b&9 '`@"X   DD ` #`D ` ` a`      &a &b&; '`@"C   D ` `D ` ` a #a@8    ``     D `D         DD ` `#` @ ` "   @8     @ `     @8    D ` ` aP@ &   @8{     @ @)   @8t    ?#@   㿈'D'D ``  $   D ``     D `  @:]    ``     D `0 @:S    ``     D    `      '   㿈'D'H'L'L(`H   7(`0`(`(`0`@'D `|@'   㿐'D'HH`      &a &b&f 'b0@!   D ``  	   D ``O        H HD@ @  `" " ` `"" ` `"" +   D ` ` a`    HD `! `@ @  `" " ` `"" ` `""    HD ` `#@ #`HD ` `0#`H `  㿀'D'H'L'P/ '/D`
/D```  	   /L``7 %   L@ `` 	    /L`7    L@ `` 	    /L`7     &a &b& &b@!   H @  ``(`0``   @ E)    '䀠`      'HH ` `#`     `'耠`    (` c$@@    H @  ``(`0``     P@ A       P`    ``     H @  ``(`0``     P@ A    u   P` q   ``  l   P` h   H @  ``(`0``     P@ A    W   P` S   ``     P`     H   H @  ``(`0``     P@ As    7   P`    P`     -   H @  ``(`0``     P@ AX       P`    H @  ``(`0``     P@ AC        'b8\   H `P@ l   ``     P`    H ``  4   P`     .    / *   H ``     P`    P`    P`         /    H ``    P`    P`         /``  '    c ``    H @ @     L@ ` s     'bX  @&    |H@L@ 3  `3 `3 HP#`P@ @      U0 Sx S S R U0 Tp Tܝ`'DD ````  	    c@!   '     c@!   ''D ``     D'D ````      2'     ' `    D'D `'؀c    #'D ` @''Ԁ@    '#`D'D' `'Ā@    '#` D@D  `@@ #  `# D `D `  㿈'DD `  @7    ``      )   D ` @ Q    'D `  @7    ``     D `  @8    D `D    D `  @9      D `,  p'DD `  @7    ``      z   D `0#@ @9       D ` #@ @9      D ` #@ @8      D `0    @8   D `<#@ @9      D `  @9    D `<D   `,@9   D `0 @9    D `< @9&          &a &b' 'b@   D ` #@ @8      D ` #@ @8      D ` #@   @9      D ` @     'D `,  㿀'D'HH@7-     @ 'D `  @7    ``     D`` ,@     &a &b' 'b@   D``#`,D `   @9   @4    D `   @9f   D `H@ '#@  @8      DD ` #`'`     {   @%        㿈'D'H'L'PL`     L @ P`     P @ DH `|@'HH0`H  ?c@     '    L`     LH` @ P`  	   PH  ?c @0`'   '  㿈'D 'L'P7HH(`0` c`h(`0`'@'D `X쀧@    P`     P @ L`     L'@     P`     PD `X'@'  L`     L @ D `X a 쀧@    '     '  㿈'D'H 'P @6S    DH @ P     'H         㿈'D'H 'P'T @69     @ 'T`     DHT~   H @  `````  3   P`    H @ H @  `#`H @ H @  ``#`    P`    H @ H @  `#`H @ H @  ``#`     &a &b'k &b@g   H ` @7     ``     H `#@ @5      H         x'D'H'L'P'TL@5     @ '@3    '/DHP    /T`     ``     P`    D`
``     ```  
    c ``     o    c `؀`     P`    ```  _   DHT   ``H `@ Q   H``#` c ``     H @ @    H$  'bД  S   H `' c ``    ܀` 
    *   ܀`     $   H `'H    c ``     H `@    H @ @P    HH$  'c     L@ 'H         @'D'H   7L/P/T 0@#   'z       '@#   '@#   ' @4   '܂'Ԃ'T``  -   P``      &a &b' &b@`    c`j(`0``      c`h7     cD `X`h@T` @77     c`h7 c`j(`0``     P`@77P+`T+`L(`0` (   @2    ' c@       @#w   $   @ `     'cht    @ m    @ 0<   Hؘ @   @ Q    `      'c   @ (`0``    @2_    `4  	   @2V    `4  tH@ @ D@@ #  `#  @@ " `"Ț @  @#&    'D `   @"m       @     'ܚD `  ܚ a   H `  @6   H `#@ @3      '#@   @6      D `D ` a `#aHH ` `#` &   @1    ``     'D `DH         'D `DH      ' `   '` 9   `    ` 
       `        D ` aP@     A    `D@ ``      `D +@  !b 'c@"K    !b@!    !b@!    &a(@"x   @1v    ``     'D `DH  9       'D `DH      D `   @!      H'D'H  /L/P 0@"+   '       '@"#   '@!   '' 'c @"   H @ @ S     `   @"u   (3` `' `' 3@ ( 3` +` +` 3`H @ @ S      @"S   H @ @ QZ     `   @"G    `
  'c @"?   H @ @ P     `   @"3   D `   @!.    tH@ @ D@@ #  `#  @@ " `"D `x  *@i    '쀠`*    @ c    '@!     'c *    D `   * Z6   L+`P+`  *p   H `  @5G   D `D ` a `#aHH ` `#`D `   @        'D'H'L  /P/T'' 0@!N   '       '@!F   '@!   ''''@     7''7D `x`     H @ @ S       @    H @ @ S     `   @    D `x'/'T``  -   P``      &a &b(D &b@    c`j(`0``      c`h7     cD `X`h@T` @77     c`h7 c`j(`0``     P`@77P+`T+`D```     D @ `     &a &b(O (`H@n   P`T`D      'L``0````     @!C   'L``0````      (`h' 7' c b@   H @ @ Ox    (` ` @ cԃ(`0`փ(`0`L`(`0`#\#`L``#d#h#l(`0`#p c `#t c `ă(`0`#x#|  h   bW    ' c b@    LC    tH@ @ D@@ #  `#  @@ " `"D `pe%   @     `'   D```  f   ' c b@x   H @ @ N    (` ` @ cփ(`0`L`(`0`ԃ(`0` c `#\ c `ă(`0`#`#d  h   h    ' c b@    L    tH@ @ D@@ #  `#  @@ " `"D `pd   @    `'   D```    ' c b@   L``'`    `    ` F       ` j       H @ @ N}    @     @     (` ` @ cԃ(`0`փ(`0` c`h(`0`#\#` #d#h#l#p c `#t c `ă(`0`#x#|  h   a]    '    H @ @ NA    (` ` @ cԃ(`0` #\#` c `#d c `ă(`0`#h#l  h     e3    ' W   H @ @ N    (` ` @ cփ(`0` c`h(`0`ԃ(`0` c `#\ c `ă(`0`#`#d  h   g    ' (   H @ @ M    (` ` @ cL``ԃ(`0` c c `ă(`0`#\#`  h  `h    ' c b@    L    tH@ @ D@@ #  `#  @@ " `"D `pc   @    `'    &a &b( &b@R   H `  @2g   D `D ` a `#aHH ` `#`D `   @      㿈'D'HDH          (`p|,   HH ` `#`D `D ` a< `#a<D`	``  
   DH           D @ `    (`0`DH     d    
   DH             㿀'D'HH `0 @/X    ``      &a &b( (`@   HH ` `#`D `D ` a< `#a<H `0 @0    @ 7`7`7H `0 @0   H `< @1    @ /H `< @2   D @ `    (`0` ``DH           ``     &a &b( (`@    ``DH    n        㿈'D'D `   @+   D@,    耣@ 2   D `    ``  )   D7    '쀠`             `           ``  	   D   '    `'     㿈'D'D `   @   D@,{    耣@ 5   D `}    ``  ,   D    '쀠`      !    `0 @.    ``           ``  	   D   '    `'     p'D'H c ``    H @ @    H `|А    ٘     (`  @   D @ `    H @,O    `H`~(`0`DH    +       D @ `
     &a &b( &b@   H @,.    `H `|DH       HH ` `#`D `D ` a< `#a<  x'D @-   'D `   @>   D ``#@ @.m      'D ``#@ @.L        @.    ``  z    @.%     @ ' ``  d   ```  ^    `p `
 @ V   D ```#  (`#@+` @(` @(`D `@ `d#@D `8@ >   D ``h#  (`#@+` @(` @(`D `@ `l#@D `8@ &   D `t    ``           ``     D    h@ D@@ #  `#  `#`p#@   @-      w     㿈'D'H'L'L @ ` Z   D```     L@+W    L` ``DH        ' x   L@+l    ``    L@+<    L` ``DH        ' ]   L@+Q    ``     &a &b)3 (a @   L@+    L` ``DH        ' 9   L @ `    L@+     `(`0`L` ``DH        '    L @ `    L` ``DH   x    '     &a &b); &b@X   쀠`      @ L@@ #  `# L +`H ``      &a &b)? (a(@9   HH ` #`HH ` `#`D `D ` a< `#a<  `'D @+    @,W   '''D `   @   D `f    ``     'D ``#@ @,      'D ``#@ @,      Ђ  @-o    ``      @,     @ ' ``  	    ``           y    ``      `#@ @,      '        'ؚ#@   @.       @,>     @ '```  ]   ```  W   ``؀@ P   @)    ``  H   `` ` `@ 3   D ` a8` -   `` `#` +`D ` `#`D `#` ` А b@@      @$` ` А b@@    $  #   (`De   ܂ `'     `#@ @+      Ă  @+    ``     }   #@   @+      3   ܀`      'D @*    c ``     (aP@   D@)c    D@)    D `D `D ` a#\D ` a0#`D ` a(#dD ` a,#h (a  !@   D ``#@ @+      'D ``#@ @+      Ȃ  @,[    ``  T    @+     @ '     @ @h         `0 @,    @)c     `  @,         `#\#`#d#h#l `#p#t @  `#x @  `#| (b(     @^   #@   @+O         DD ``h @ ]    ``     Đ @)   'D `D@(    !4 @'	?`  	    (bX @  `H??D ``#@ @+B      'D ``#@ @+!      Đ  @+    ``  K   Đ @*     @ '         `'  `@     `@'
?D ` a8@    '	? (b` @  `            (b` @  `?H?Ă#@   @*         D ` a4	?DD ``h @ B        'D'HD ` aP'XP @)X   H @*   D @*   '@'4 ',''7HD @ `#  (` @(` @(`HD ``#  #@8     '\\`     '\D `  aP@p    @U   D `  aP@    @I   D `! aP@p    @=   \ #@    '`\ #@     (` @(` @(`'dX a`     X @  `pp`    @    'l@ n    '    \ (` @(` @(` @   'll    `       D `   @   l     (bhv   l`     '   D ``#@ @*      'P/D ``#@ @)      P  @*    ``  	   l@     /` h   P @)     @ 'LL ``     P   L `#@ @)@      'HH'DL@'    '<<`  
   D#@   @,      '88<@-   l@(   D'HL `#@ @)      H  @)    ``  
   D#@   @+      H @)=     @ '@@@'%    `7@ @ `     &a &b*  (b@   @@'
     @ 'TT`     T0`(`@T`?0@```      T0`(`@T`? 0@```     T0`(`@T`>0@```          `''40,T  ?c  ` @$    `     @ _    '00'||` "   |` B   |`c :   |`c    |`  &   |` &    H   |` ,   |` $    >   |`    |`    |`     0   |` ,        '4 <    '4 8    '4 4    '4 0   L @ @    0@       (b 0@    uZ       L @ @    0@y       (c  0@    @5   4`  #   @@&/    ``     H'D `DL         H'D `DL 4 h   8 `'8   P#@   @(l      }   `  @  '  㿐  7D7H    @'D'HD `   @?   /' @'   'HD @ `#  (`#@+` @(` @(`H `@D `#@'쀠g    ''Dܞ `t   dL    'D `   @   耠     (c(tU   耠`     HD @ `#  (`#@+` @(` @(`H `@D `#@`  n    / q   耠` f   DH `@ #  (`#@+` @(` @(`D `@H `#@  Âa@@     /ς    @$   ' 7D o    '`      5    @  @ G    ` @(    ``      #    `#@ @'-      '#@   @*      'D       ' 	   ς``     @   `  @     'D'H//'''''' @&   ''|'x'pD `   @V   HD @ `#  (`#@+` @(` @(`H `@D `#@'g    ''D `t   `   'D `   @*   ܀`     HD @ `#  (`#@+` @(` @(`H `@D `#@`      /B   ܀`     0   DH `@ #  (`#@+` @(` @(`D `@H `#@  Âa@@     /`        @ <  @  @        @ 0````       D```  t       @)    `' 7D s    '`  ^    @  ܖ  c   `	``     `P +@  `T#@ #`#`#` @    ``#@ @&'      `'@$~    'h/'llh@ *   ``  %   \#@   @(       @&F     @ '@$V    ``	`@     'p /l `'l   `	``   D```     @ 0```(` `@    k    @ 0```(`܂@'Ԃ    @    `' 7D     '`     J    @  ܖ  c+    `X#@ @%      X'@#    'h@ 7V/'llh@)   `` $   \#@   @(k       @%     @ '/w'p c@!    `   @#    ``   @#    (`0`V(`0`@    @#    (`0``(`0`@     @ @ C     @ `      c`j(`0``     `(`0`|xD       /w     ` |xD       /ww``     Ԛ|xD `      /ww``     x`     ``|@        w``     x`     ``x@        w``  +    c ``      ܂@ @ '\\ @     (cX @Z   @"    ``  	   ``'x'|    ``'|'x@"    ``      / O   D @ `    ```     'p >   ``0````  %   D @ `	    `(`0``      'D     'DD'p    D @ `     'p     'p     c ``    `` (c q]       /l `'l   `	``+    @ 0```(` `@        @ 0```(`܂@'@ ``        @ 0```(`܂@ `' @ 0``` @ 0```@(` `'dD```  
   D```          `'d@     c ``     (cp      D```  
   `	``       D```  
   `	``           @    `' 7D     '`     g    `P#@ @#      P'@"#    'h/'llh@Q   `` L   \#@   @&       @#     @ ' c@K    `     &a &b+ (c@L   @!    ``	`@S    @ @ A     @ ` H    @ @ Am     @ ` =   @!    (`0``(`0`      ``     (   `	`` >   D```  8    @ 0```(`؂@'@!    ``   @ (`0`@!    (`0`     `(`0`@!    (`0`          @     J   `	`` 5   D```  /    @ 0```(`؂@'@!]    ``    @ (`0`@!t    (`0`     `(`0`@!    (`0`         D```      &a &b+ &b@
   @ ``    ```  9   ``` 3   ``` -   ``` '   ```	 !   ```
    ```    `` (c o   `(`8` В pO   )   ``'@@` :   @(` `@@     'p @    'p <   D @ `     'p 3    'p /   D @ `     @ @ @W     @ `      'p     'p     'p    `` (c o;   `(`8` В o   p`          /l `'lw   `	``    D```      @ 0```(` `@         @ 0```(`܂@'̂    @    `' 7D &    '`          `L#@ @!      L'@ M    'h/'llh@ {   ``  v   \#@   @$       @"     @ '/w'p c@s    ` X   @     `` P   @ N    (`0`@ (`0`@ C   @ )    (`0``(`0`@ 6    @ @ @     @ `  +   @ )    (`0`@     (`0`      ``     @    (`0``(`0`@         'p /l `'l   ``  	   ``     x   ``  !   @m    ``     '\\D  1       '\\D p     `P@ ``  g   D `TS    '`  \    `H#@ @!%      H'@|    'h'llh@ D   \#@   @#       @!J     @ '@Z    `` (   @    ``     '\\D          '\\D    M   ``      /    l `'l    `P(@ `         p p p p p ` ` p p `㿀'D/D `   @    D!@ `@ D@@ #  `# D `D ` a<#aHD x   D`	``     D     / '   D `t`     D     /    D @ `    D K    /     &a &b,Z &b@    ``  
   D ` a`        D `   @   D!@ `@ D@@ #  `#   㲀'D'H'<H@I     /`    //3/D @ `       3``  L   '4H@/    4@ C   H4@     @  @q   '@<@'$<#@'4`      &a('     )`0' )`8@|    '88`  
   8< @d         )`Hl   <8@'<4 `'4   '<DH  @C     @  @m     c ``  @    d  O>   $ tD```  
   D```      s   3``  1   H  @     @ ,#@ @ >      , @m   '' D```      )`h'     )`p'@ (  )`x @
    '8 -   H  @
     @ (#@ @ =      ( @>   ''D```      )`h'     )`p'(  )`@    '88`     8g         )`l   8'<    D```  R   3``      H  @
     @ $#@ @ =      $ @    @ (  )` @    '8    H  @
     @  #@ @ =s        @     (  )a  @    '88`     8g         )`k   8'< e   D`	``  V   H  @
Q     @  @ ?    '`      &a &b, )a@   @ ` @@ ` @@ ` @@ `#\ @@ `#` @@ `#d (  )a  @-    '88`     8g         )`k]   8'<     &a &b, &b@H    c ``     )aP @
   H  @	     @  @    D `t ^m        H'D @    @Y    @U   ''''Ԃ /'//ʘ    ? c ``     D `   @    D@@ '`'Dܾ   D@A    `        D ``#@ @      'D ``#@ @        @U    `` l    @     @ ' ``     ~    `         /-   '̂˚  ֌    ' `  @    `      `,Ԁ@    ʂ``     3        `,Ԁ@    _    `#@ @      ' `#@ @        @    ``     '#@   @       @     @ '```  #   D ``#  (`#@+` @(` @(`D `@ `#@Ҕ      	   '    @    ``     ```     ```  |   ʂ``  @   ``Ԁ@
 9   D @     'D @ `    'D ؘ  N       'D ؘ     ˂``  ~    `d @ D@ w    )ah@    `dD#@  m   ``Ԁ@
 2   D ``#  (`#@+` @(` @(`D `@ `#@̀@    ``Ԁ@     &a &b, )a@   '     6   @    ``     ```  (   ```          D ``#  (`#@+` @(` @(`D `@ `#@̀@ 	   ' ު   '   #@   @1         D+    c ``  &   D `   @   D `#@ (` @(` @(`D `Ă#@ #@     '`     )a@	        x'D @      @
   #@D@
      '#@D@      ܂  @    ``  &    @$     @    @ <j    ``      @     @   @ ;   #@   @r           p'D'H'L' cL#cD@2    `        D    @   '00DHL@       ',,0@   ',,@
   0' c ``  n   D@	    ` @  /cc``     \#@D@
]      \ @
     @ h   @ :       D@    h   )a @
W    `' @
    'dL   '(h'$ `'  ` a8`     )a'     &a('c``      )b '     &a('#\d `#`d `#d$  )b($  a8   DN   @    `                  `   @	          `   @	      @ p    ``    d @   'X `@_    !4 @'	?`  	    )b @  `H??@ ``<#@ @      <'d ``8#@ @      8d  @f    ``  K   d @     @ 'XX    Ӳ     `'TXT  `@
I    X `@'
?H ` a8T@
;    'H	?HH )b @  `            )b @  `?H@HH?@d4#@   @c          ` a4@	?@ `h@D  @    $ m   =    c ``      ` aL`  K   L   ' `D@     !8@	   ' `h` @ #@ (` @(` @(` `h` `#@ #@	     '	 )b @  `? L`     )b@'     )bH'#\$  )bP     D   L8   ' `h` @ #@ (` @(` @(` `h` `#@ #@	     ' )b @  `? `' ` aL`     )b'     )b@'#\$  )b aLh   '䀠`     K   @	-   '  㰘'D'H'L'P c #cP bL''D@ 8   '܂ 'L`        @ (`8`` ܂@@ (`8`` ܂@@ (`8`` ܂@@ (`8``#\   )bИ  @l     @    ' c ``  
    c ``      &    @    '  `      &a &b- )b@~   D $@ 8      $  )b     'L@   D  @ 9    ``     '    @H@@ 7`7`7
(`0`
(`0` "  )c  @	    c ``  	   $  )c0     @         @    `  E    )cH@}   ؀`  /    c ``  
    c ``         $  )c`   ؂ '@   PP   $"LP bL`        P bL' '    !b )c@   @d   P?#bL    (    c5    '耠`      )c@,   w    @(w c ``      @H@@ (`0`ؐ$  *`   +   ؃(`8``5 B    @H@@ (`0`c     !b *`(@    @>    !b *`p@   L@     @H@@ (`0`c     `'    @H@@ (`0`` !    !b *`@    @    *a    @    `    ؚ (   b    '耠`      )c@       耠`  *   `     D `` @H@@ (`0`      @ !       D `` @H@@ (`0`      @ !        @(w c ``  	   ؐ$  *a     * a  @^    `       c ``  
    c ``          !b *a(@    (  
  bF    '؃(`8``1 
   ؃(`8``2     t   D `` @H@@ (`0`      @     ؃(`8``1 n    (    b    ' @(w耠`  \    c ``  	   ؐ$  *a`    ؃(`8``4 I   ك(`8``2 C   ڃ(`8``6 =   D `` @H@@ (`0`   @ !    c ``  
    c ``      !    @H@@ (`0`$  *ap        D `` @H@@ (`0`      @  ?    `'    c ``  
    c ``           @i    #@$  *aL         㿀'D'HD `'䀠`  l    `,` g    `0'H'@8` (` @(` @(` @(` @(` @  ' `4'`0'`4耠    ?'`4D `?'`0D'` <    (` @(`H@ `,` '   ?'`4D `'`0 (` @(`H@D `H'@8` (` @(` @(` @(` @(` @  &4D'`     (` @(`H@'     ?c'D'H'L'P cP#c''/''?`_(@D  @ 7    ``     &   P`
     *ac   D ``  @ !    `      c b`    D ``  @ !    `         c ``     D@ 5    $  *a       @   D @ 6V    'P`
 	    ?`D @ @      ? D #  !? D   ' +` @  `?'L''x    @T   ?a @    @K   ?a @ `    @A   ?a @ a     @7   ?a @  a#@ c ``      c `'     ' c ``      c `'     '@   '??a @ a     @   ?a؂ @ `?a؂ @ `  @    ?a؂ @ ` (` @(` @ J   '?a$ @?a؂ @?a$` @@    ?a$ @ (` @(`@ #`,?a$ @ (` @(`@?a?a$ @(` @ `@ @ " ?a$ @ (` @(`@0`?a$ @ (` @(`@?a$ @ # 4?a$ @ (` @(`@?a$ @ (` @(`@?a$ @ (` @(`@?#`?"?# ?a؂ @ ` ?a$ @     ?a$ @ (` @(`@?a$ @ `# 0    ?a$ @ (` @(`@?#`0?a$?a$ @ ` @^   ''?a؂ @  @C    ''` 0   `	 ,    (` @(` @(` @(`@?bЂ@' c ``  ,    (` @(` @(` @(`?bК@$  *b `       `	      I`@' c ``     $  *bPI     Úa@@ 6   #?`@@$@ ?@      ? @ #  !? @   'ؕЁ   	        ؕ?`8 @ @  `    !? 8 $  $ ?`8 @ @  `?D  @ 4    ``     
   ?`_@``     ?aD ``?aؐ  @!  @     @ %   ?aD ``?aؐ  @!  @     @?a؂ @`      c b`  	   ?`_ (@    c b`      1   ?a؂ @`      (   ?a?`` @ @ @    ?`` @`    ?`` @ ` `    ?`` * @"@    `    ?a؂ @`     G   '?a؂ @ `?a؂ @ #` `' c ``  @   ``  ;    @    ?`X @?`X @`      &a &b. )b@    P    ?a( @D $@ 2    ?`X @?`X @$  *b  `6    /` Y   @ ip   p   @g   pD @ 4    ``     #   '`     `0     `0 (` @(`@?4"     ?`4@#@ !? 4   ' `,`Z   `(`8`(` @p `#@ (`#@+` @(` @(`t@`(`8`(` @ `#@D `@   `(`8``    ?a؂ @ ``  $    c ``     ?a؂ @@ (`0`?a؂ @``$  *b     ?a؂ @ #`   D#?`0@$@ D `애 +` @  `HH?0 "? 0    ? , #   `!? ,         `#?`,@$@ ? ,   ? 0   #  c `` 	   $  *c@ b    #`, `0     `0 (` @(`@ `4#`4 `4     `4 (` @(`@ `0#`0@     `0`      `0 (` @(`@!? ( $      ?`( @ @ ?( '?#`0?#`4Ȃ '     c `Ѐ`       @ ~    c `` 	   $  *cP@    ` `3``(`8`(`@ `   @*   `(`8`(`@`'p`'tD@ 0    ?a؂ @@ (`0`?a؂ @``#@8` (` @(` @(` @(` @(` @  `(`8`  
     @      
   ?a؂ @ #`    `     @    |    `,`     *c`,_#   БH'Ȁ@     k    c `Ѐ`       @     c `` 	   $  *c@ s    #`,0`Ȃ `' `   @    D@ 0%    ?a؂ @@ (`0`?a؂ @``#@8` (` @(` @(` @(` @(` @  `(`8`  
     @      
   ?a؂ @ #`    `     @:   '    c ``    БH'D `#\#`$  *c    '?a؂ @ ``    x?a؂ @D  @ i   ?a؂ @ ``        x :   D  @ 1    ``        ?a?a؂ @?a؂ @?a؂ @?a؂ @ @ `@    ?a$ @?a؂ @?a$` @@ _   ?a$ @ (` @(`@ #`,?a$ @ (` @(`@0`?a$ @ (` @(`@?a$ @ # 4?a؂ @ ` ?a$ @     ?a$ @ (` @(`@?a$ @ `# 0    ?a$ @ (` @(`@?#`0?a$?a$ @ ` @   '''|'`     `       `     +` ]   'L c ``  9   L`  5   p   @h   P    D@ 0    p#@ (` @(` @(`t#@ #@      ' +` @  `#\$  +`P ?  L   D  @ 0   @   @ h        㿐'DD?#@ D?#`D c@      (` @(` @(`$   㿈 'H   @     H@          x'D'H'L' c ``    LLL$  +`@     HD @ @ #  (`#@+` @(` @(`H `@D `#@'쀠`     ?Ϛ`@     c `` 
   $  +a   	c     	c'L @  1   L ` ,   L#@ L'L @   c@    L @ ' `䀣@ 
    `'      c' `LLL `(`   @" `    a@    쀠`          c ``      +ax\       L @ #@' c`@    L @   @@L ` @@쀣@     c ``     L$  +a@        LL8`   @" LL8`@ @L `#@8`  @"LLL `(`   @"L ` Ƃ``@     !b +a@   L `#`L c@      (` @(` @(` c@      (` @(` @(`L  `@B   $  c `Ѐ`     L' c `Ђ (` @(` @(`L `''؀@    ' ` c ``    LLL$  +b8@          㿀'D c `Ѐ`     D`  {   D  @    u    `D @      `h  @    `D @ D`  c   D `h @    [      @    `h @ #@ (` @(` @(` `h `#@ #@S     ' c `䀣@ '    c ``     c `#@ +bh @    c `#@ (` @(` @(` @7    `h  @Z    	    `h  @N   D`     D `h @D        㿐'D'HDH@    $ D  @7    D@D@ #  `# D `    @   D `    @        㿐'D'HDH@}    $ D  @    D@D@ #  `# D `    @e   D `    @^        㿐'DD ``     D `@h   D `  㿐'DD ``     D `@Y   D `  㿀'D'H c ``     ' p   H`  	      @   'HD ``  $   HD @ @ #  (` @(` @(`HD ``#  #@v       a0@     ' A   ' >   HD @ `#  (` @(` @(`HD ``#  #@T     k    ' "   HD @ `#  (` @(` @(`HD ``#  #@8       a/@    '     '  P'D'''P/P`  	      @N   'PDPp    ``     '     D@P@ #  `#  +b @  `           '     +b @  `        +b +b!? +b@ b   PD @ @ #  (` @(` @(`PD ``#  #@     'ܕ葢ȑH'܂#@'  a/@    ' x   D ``      / ^   DP `@ #  (` @(` @(`DP ` `#  #@     'Ԛ#@'Ԃ#@`  	   Ђ  '#@''Ѐ`      / ,    c ``  $     c @     ̕?''@    ' +b @  `H            /˂``     DP@      `'    'ā  P'D'''PP`  	      @g   'PPD @ @ #  (` @(` @(`PD ``#  #@     'ܕ葢ȑH'܂#@'Ԛ D@P@ #  `# DPԐ #@    @  @$ DPԐ #@     (` @(` @(`` @$  DDD `  А b@@      @$`DD `  А b@@    $  D `'̂̐ @w    'Ȁ`      +b +b!z +c @ =   Ԑ #@    'D +cX @  `H? `#\А .@    #`А .@      <@    #dА  <@    #h$  +c `   $        㿈 ` @ `     '     ` @  `  #@  ` `p ` @ @ {b   $    $@  ` #@ '  㿀'D   D`'耠`     D#@ `'D ` `p ` @ (`@  #@D@ ` @ @     ` @ ' ` ` @ D@#  ' 	   @  
   D    '  㿐 ` ` @  `#@ `     +cX    ` ` @  @#@  ` `p ` @ (` ` @ @ z   $@@$   x'Du    `p ` @ (` `  @ @' ` @ 'D' ` @ 䀣@    @ (`8``      `   @  `#   (@ `"     ` @ 䀣@      `   +@  `#   ` @ #@`'`      ` ` @ #@ `#  ' 	      D    '܁   ` @ `     '<Y   'L "  +c         +cX6     ,` @     ,`@    '쀠`      ,` W    `Ȓ    @   P $ @    `    L `'LP'PP@ (`8``     P@ (`8` @    `     P `'P   P@ (`8``#       PhVX  ,`P   @    '@@`        `V(`0`c(`0`(`@'H'DH`  2   V(`0`H @  `(`0`@     XH @   `@D    `      c ``     V(`0`X ,``  W    	   H'DH `'H   H`     y   X  ,` @6    `      ` ` @  `#@  N   X  ,` @"    `      ` ` @  `#@  :   X  ,` @    `      -   X  ,` @    `          X  ,` @    `          c `` $   X ,` L W1          'HH    $  H `D`      `V(`0`c(`0`(`H#     DH#`H @ h [   $  H @ V(`0`#`H @ X N   $ H @  `   @    `Ȃ #@ '<<  㿈'D'H        ' 2    `D;`0`@8`
(`
#@(` '쀠`  !   D(`0` @  `(`0`@     @ H `@V    `      @ '     `'   '  p'D'H''''V         ,`Vj     @@ y   ' '؀d  '   D`     ؘ@؂@@ `+  Ԃ `'H`     ؘ@؂@@ `+  Ђ `'؂ `'   '؀c w    `؃;`0`@8`
(`
#@(` '܀`  b   D`  +    @  `@@ `````      @  , `` @Z    `      @  `@ @  `@@ `+  Ԃ `'H`  ,    @  `@@ `0`````      @  , `` @,    `      @  `@ @  `@@ `+  Ђ `' `'   ؂ `'    @ xj   'D`  	   Ԃ @ @ x_   $  H`  	   Ђ @ @ xT   $ #`#`'  ?c@ 2   ؂@@ ````        @  3  `" ؂@@ `0````        @ 3  `" ؂ `'   @      p'D'H''''>         ,`UR     @@ w   ''؀c w    `؃;`0`@8`
(`
#@(` '܀`  b   D`  +    @  `@@ `````      @  , `` @m    `      @  `@ @  `@@ `+  Ԃ `'H`  ,    @  `@@ `0`````      @  , `` @?    `      @  `@ @  `@@ `+  Ђ `' `'   ؂ `'    @ w}   'D`  	   Ԃ @ @ wr   $  H`  	   Ђ @ @ wg   $ #`#`'  ?c@ 2   ؂@@ ````        @  3  `" ؂@@ `0````        @ 3  `" ؂ `'   @       ` @ `     'L    '\ "  ,a 
^         ,a0T     ,ap@4     ,a@g    '쀠`      ,a TD    `В  $ @O   ` $ @    `     \ `'\`'``@ (`8``     `@ (`8` @k    `     ` `'`   `@ (`8``#       `hf  ,a  @     'PP`        ` @ 'X'TX`  $   f(`0`X @  `@     c ``     f(`0` ,aВ  T    	   X'TX `'X   X`         ` ` @  `#@     'XX    $  X `T`      `f(`0`(`X#     TX#`X @ h &   $  X @ f(`0`#`X @  `[   @    `Ђ #@ 'LL  㿈'D        ' $    `D;`0`@8`(`#@(` '쀠`      @  `D@     @ '     `'   '  㿀'! '         ,b SN    @ u   ' @ @ u   $ #`'@       @ 3  `"  `'      x''         ,b8S      ! @$   '` 1    `;`0`@8`(`#@(` '䀠`      @  ` @~(`8``  	    @  ` @ +~܂ `' `'    `'    @ u   '܂ @ @ u   $ #`'`     @~(`8``        @ 3  `"  `'      x b @ `     $    b #@ ' `؂! #` ` ` ` ` `(`    $   ` ` `(`    $  "  ,bhy         ,bxR     ,b@O     ,b@    '쀠`      ,b R_    $ @(    `     ܂ `'܂' ` `` `@ ?    ` `  @ @(` \   ' ` ` `(`@  @    `#@  ` `  @ @(` B   ' ` ` `(`` @    `#` ` ` `  @ @# @ (`8``     @ (`8``#    @ (`8` @    `      `'   @ (`8``    @ (`8``#    ,b@    '耠`     t   (@ O     ` ` `(` @ @  `'@ (`8``     @ (`8` @    `      `'   @ (`8``     B      
@     ` ` `(`@ @  ` ` ` `#`*   @        㿈'D   ' ` `쀣@     `(` @ @ D@     `(`  @ @ '     `'   '  㿐'D'H   D ` `#@ H ` `#@  ` ``      ,bQ>        `'D 'L'P'T'X7H'Ԃ `'ܒ   (@:    `P @  	    `P@ t   $      c `` &   L`   *    H(`0`H(`0`  c@(` `P @ @X(`@T@#\ ,cXP  TX@   L` /    `D @ @       b@ (`0`H(`0`@ 
    `T @ `         `L @      `L @ @?    `L?#@  b @  `TL#@  `D @ #@  bH3@     @    7D @ 'H7L` R    `L @  L      @     `L @  @      ,cP    `L @   @    '؀ &    c ``     D @ 'ЂА @y    H(`0` ,cؒ  Q    `L @ @    `L?#@ ?'     `L @ =G    "   L`     `H @         @     `H @  @      -`P    `H @ =%    `܂ #`H(`0`  c@(` `P @ @X(`@T@#  P#` `P @  c@  bi@# L` H    c ``    ܒ (P    `H @ ܔ (    @~    '؀    @ q    '؀ 
   Ԁ`   Ԁ`   ؀ B    c ``      -`8P    `H @ @C    `H?#@ ?' ,      `(' `L @   ,  T    '؀     c ``      -`XPX    `L @ @    `L?#@ ?'    '́  `'D'H'L'P'T'X\ @  ``    L ``\ @ @ (`0`\ @ ``      @ X   D'H`    H`     H` -    ``     &    c ``    \ @ ``  )    \ @ @ (`0` -`p  H@   \  `T ` '"    @ ' `P @ #@'0`  c@\ @ @ (`0`  c@  +    c ``    \ @ ``  (    \ @ @ (`0`0`  c@ -`   @   \  `T ` '   0`'  ?c@'\ `耣@     -aO   \ #`T ` '    ``     -a8`O	   '    ``  	    ``          -ap` N   \ #`T ` '    (` @(`P@' `,`     `,`     `,`     `,(     -a N   \ #`T ` 'p   `(`8`䀣@    `(`8` -b  N   \ #`T ` 'U    `0     `0 (` @(`P@ `4#`4 `4     `4 (` @(`P@ `0#`0X `@    X' `0`      `0 (` @(`P@'    '# ?#`0?#`4(`@`'`'ܚL `     䀠`  0   T'TT @ T ` ```HT `    	        TT @ T ` ```H?    T ` ? ` ` :   T `0`  5   T #`0TTT ` ```H# # T ` ` -cP @  `   	     	   T -cP @  `#`#` c ``     T ` `H'$  -b` '    `,`    TT ` #` `` )    #`, c ``    \ @ ``  'F    \ @ @ (`0` -b    M   \\ ` `#`' d    `` ;    c ``    \ @ ``  '    \ @ @ (`0` -b    M    #`,\ #`\ @ #`\ `#`\ `#`\\ ` `#`T ` ' &    ``      -bMl   \ #`\ @ #`\\ `#`\\ ` `#`T ` '     -c8M    'ԁ  㾠'D'H'L'P'T?' '< `H @      `L @    L ``    h    @    `H @ `  $   T @ ```     `H @ 0` (`@ (`@ `H @ ` (@?x@"x `H @ ' 7    `L @ `  +   T @ ``` $    `L @ 0` (`@ (`@ `L @ ` (@?x@"x `L @ 쀣@     `L @ '     -cXL      L `` |   X   @B   XD @     ``     k   D ` А b@@    'XD ` А b@@    '\ `hX      @    'dd`     G   d 
   @ nd    `        `H @ `      `H @ 0`(`@ `H @ `?x0@```      `H@< @  `"     @1    'TT`      c ``  
    c ``          -cL   L `T #`    c ``     -cT@   /0#@D@       0D@    B(`0`T @ @ (`0`@         /`  N    c ``H   ,#@D@       ,`(#@D@       (0``$#@D@       $0`` #@D@        0``D`D0``D0``D0``B(`0`#\#`#d#hT @ @ (`0`#l -cВ     @f      T#\ `TDHLP    `    p    `L @ `     `L @ 0`(`@ `L @ `?x0@```     `L b @  `@ b"  @ #@     @    'TT 
   @ m`    `       T`  #    c ``     T     .`(K       T @ @ (`0` .`` Kh   L `T #`    b b @ T@#   b @ ` &    c ``    T @ ``  $    T @ @ (`0` b .`    @   L `T #`     ` @ c@'4 b @  4@ '    c ``    T @ ``  $    T @ @ (`0` b .`  4  @   L `T #`     `'8T#\84DHLP'    `         84@'8  `#@8@ b @ @    8 @ c@'48 `'8 &   8 `#@ b @ @     b b @ 8#@ `@#   b `8@ @+       b @    4`    4`      $   L ` c ``    T @ ``  $    T @ @ (`0` .aH  4@   T #` .   84@ `#@ b @ @{    b b @ 8#@ `@#   b `8@ @    `4#@  b b @  `#@      㿐 `H @      `H @ @    `H?#@  `L @      `L @ @y    `L?#@   㿐'DDD(`7@ D `D `DDD `'`' DD `'`D ` D '`$D `(DDD `4'`0' ,DDD `@'`<' 8D `DD `H  㿐'DDD(`7@ D `D `DDD `'`' DD `'`D ` D '`$D `(DDD `4'`0' ,DDD `@'`<' 8D `DD `H  㿐'DD ``     D `@   D `,`     D `,@   D `0`     D `0@   D `4`     D `4@   D `8`     D `8@   D `<`     D `<@   D `@`     D `@@   D `(`     D `(@   D `H`     D `H@x        㿐'DD ``     D `@j   D `,`     D `,@a   D `0`     D `0@X   D `4`     D `4@O   D `8`     D `8@F   D `<`     D `<@=   D `@`     D `@@4   D `(`     D `(@+   D `H`     D `H@"        㿈'DD `$' '(@ D ``     D `@     耣@    D `@   D `@      @'D ``  "   D `@     `耣@     .a@   D `@   D `@      @ 'D ``  (   D `@     `耣@     .a@   D `@y    .a@s   D `@i      @ '  p'D'HH`      .a .a  .a@ e   H   @y   HD `H#`HD `D#` HD `#`HD `#`HD `#`HD `#`D `` 	   D ``     A   D `(`      .a .a  .a@ .   HD `(#@ H'D ``     '     
'#`H #`HD `0#`HD `4#`HD `8#`HD `<#`HD `@#`H   '    D `$` 	   D `$`     8   D `(`      .a .a  .a@    H #`HD `(#@ H 
#`HD `,#`HD `0#`HD `4#`HD `8#`HD `<#`HD `@#`H   ' t   D `$`	 2   D@ (`0`'D```     .a'     .a'    '쀠`     H@  @ H #`H `HD `,#`H   ' ?   D `$`    H #`H .b #@ H #`' -   D@ (`0`'D```     .a'     .a'    '쀠`     H `H @ #@ H #`'    ?'  㿈'D'H'L'P'T'XDH#`$DP#`DL`     DL@M    $ (l`     Dl@C    $ HT`  :   T@
    '쀠`@     @'D ` @ i   $ ,D `,T@   D `,@(@ D `,'@ ``     @ ` @    `      .+@  `'   X`  :   X@    '쀠`@     @'D ` @ iP   $ 0D `0X@   D `0@(@ D `0'@ ``     @ ` @    `      .+@  `'   \`  :   \@    '쀠`     'D ` @ i   $ 4D `4\@D   D `4@(@ D `4'@ ``     @ ` @    `      .+@  `'   ``  :   `@V    '쀠`@     @'D ` @ h   $ 8D `8`@   D `8@(@ D `8'@ ``     @ ` @J    `      .+@  `'   d`  :   d@    '쀠`@     @'D ` @ h   $ <D `<d@   D `<@(@ D `<'@ ``     @ ` @    `      .+@  `'   h`  :   h@    '쀠`@     @'D ` @ h`   $ @D `@h@   D `@@(@ D `@'@ ``     @ ` @    `      .+@  `'     'D'H'L'P'TDH#`DH#`D `` a   DL#`DP#`DT#`L'   '쀠`      .b'D `(`     D `(@   D@    $ (D@    $ ,DD ``     hD   .b `@9       hDD   .b(` @,   Dh @{    $ 0hD   .b0`@   Dh @k    $ 4    D ``    D `(`     D `(@n   D .b@@T    $ (  㿈'DD `    l@D   D `t    @=   '쀠`     c(`@`     D(` @ c(`@(` @ g   $ t `'   D @ D `  㿈'DD `    l@   D `t    @   '쀠`     c(`@`     D(` @ c(`@(` @ g   $ t `'   D @ D `  㿀'DD ``     D `@   D `'쀠` E   D(` @ `t`  8   ' c(`@耣@ '   D(` @(` t@ @ `     D(` @(` t@ @ '䀠`     E   @    `'   D(` @ `t@    `'     㿀'DD ``     D `@   D `'쀠` E   D(` @ `t`  8   ' c(`@耣@ '   D(` @(` t@ @ `     D(` @(` t@ @ '䀠`        @v    `'   D(` @ `t@R    `'     'D  'P'T7H/LL``    L``     '`     '`    '``'dT`     .a .a! .bP@    T`     c ``  
    c ``     B   P`     P@ (`8``     h   .bpP@       /hTY   '\L`   u   'XH(`0`'Th'PD `'LD ``      .b'LL#\$  .b\TXP   $    T`    T`    T`    T`    T`    T`    H(`0` .b TC   L``     H(`0``     .a .a! .b@ i   H(`0`L`D  @ y    '쀠`  B    c ``  #    `T@    P`  	   P@ (`8``     L`       H(`0` .c  Cl   Dd (` @  @(` @Dd (` @  @(` @ ` "      L@\     M   'H3@ L+`DD @  `#@ H(`0`L`D  @    T#`Dd (` @T @(` @Dd (` @T @(` @ ` `"P`     P@ (`8``      ``      `@    P@    $      p'D  7H/L'H(`0` .c0 @   H(`0`L`D  @     '쀠`     ?'    H(`0`L`D    @ M    c ``     ``   A     `    H(`0`$  .c@     $ [   L``    D'L``    L`` 	    `(` `,'     `(` `P'     `(` `'D'L``    L`` 	    `(` `,'     `(` `P'     `(` `'  # DD @  #@ 'Ԁ         @e   '  㿈'D'H'D ``     D `@<   H`     D `    H@    ' `'D@ ds   $ D ` .cpH@        㿈'D'H'LD'H`    H`    L(` `,'    L(` `P'    L(` `'    㿈'D'H''耠`    D (` @H @(` @ `@' `'      x'D'H'L'PH`  T   H```    H```     '     '    '' b(`@`      .a .a"8 .cx@ w   H```     H@ (`0``     .a .a"9 .c@ a    b(`H@ (`0` @ @@ (`0`' `'    La     '    L`    L`     '     '    '''D(` @ `t`  .    c(`@耣@ %   D(` @(` t@ @ '䀠`     P`  
    `P@        '     `'   La     쀠`     D   PJ    '    '  㿀'D  7H/LL``    L``     '     '    ''L``     H(`0``     .a .a"W .b@ ۹    b(`@`  
   D(` @ `t`     H(`0`L` .cВ  @    b(`H(`0` @ @@ (`0`' c(`@耣@     .a .a"\ /`@ ~   耠`      .a .a"] /`@@ q   耠`     H(`0``     H(`0`L` /`P  @   '    D(` @(` t@ @ '  㿀'D  'P7H/LL``    L``     '     '    ''L``     H(`0``     .a .a"k .b@     b(`@`  
   D(` @ `t`     H(`0`L` /`  @	    b(`H(`0` @ @@ (`0`' c(`@耣@     .a .a"p /`@    耠`      .a .a"q /`@@    耠`     H(`0``     H(`0`L` /`В  ?       D(` @(` t@P#@   x'D'H'LD`     ! '      @''D`    D`     '     '    '' b(`@`      /aD?    c(`@`      .a .a" /aH@ p    b(` @ @ b   $ L`     H@ (`0``          '    ' c(`L@"'L@     b(` @H@@ (`0` @ @   2  `'     㿈'D'H''耠` Q   D@  Q    ``      A   H@     :   H`  !   DC    DH>      )   D6    DH1         H@    쀠`     D     D             ' `'      㿈'D'H c ``    ' H   H`    H`     H`    H`        ' 3    ' c ``  
    c ``          c c `  @ @(` @ @ @ @	    'DH    쀣@     '    '  㿈'D''耠`    D    ``      `' `'      㿈'D''耠`    D    ``  
   D    @' `'      X'D'H''' 7 7 7Ă 7Ƃ 57Ȃ P7ʂ q7̂! 7΂!7Ђ!7҂"*7Ԃ"|7ւ&7؂-=7ڂ ''H@ A   '@ 6    @D@@ (`0` @@Ѓ(`0`      䀧@     @D@ @D@@ 7   @D@ @@7   `'     `'    `'     㿐'DD cpD dD@         㿐'DD cpD dD@         㿐'DD cp`     D cp@   D dЀ`     D d@        㿐'DD cp`     D cp@   D dЀ`     D d@߾        㿐'DD@          㿈'DD@ o    `     '     '   㿈'D'H'LD d`      ' %   D da      /ah /a  /a@ T   H`  
   D cDH d@   L`     LDd @ '  㿐'D'H'LL`     La          /ah /a  /a@ %   D c HL@   DL#d  㿀@''DD@      '쀠`      @ #@     '#@   㿈'DD c'@ (`0``     `'    '  㿀'D'HH`  	      @ޔ       H @ ' `'D dĚ#@'(` @(` @(`D dȂ#@ #@D     '   㻐'DD @     /a@v    `     D #@  
   D@    `  `?$  D `D `D `D #`D `D(`D `XD( #`\D ``D `dD@ `=       a@޸     ?`@4 hD0`jDDD `#`# lD #`D `D `D  	c#cD d#cD##cD 
#cD #cD  ab#cD##cD##cD `D `D `D `D?#`D `D `D bD bD bD?#bD bD bD `D #`D c DDDDDD c#c##"""cDDDDDD c@#c8##"D"0"c4DDDDDD cH#c(##<" "$"c,DD cP#cLD cT    @   D?#chD clD !b#cdD dĐ   @ݧ   DD(d+dD cp`     D cp@   D cp $  /a /b @ݡ   D dЀ`     D d@   D @    $$D(dD +ctD(cD cxD c|D(cD c  㿈'DDD cc 'D c@'D c @'D c$@'D c,@'D c0@'D c8@'D c@@'D cD@'`  @  '   㿐'DD c<`  @     㿈'DDD cc  D c$@D c(@D c,@D c0@D b@D c8@D c<@D c@@D cD@`      '     c c b`      '    '  㿀'D /b'D c `     D @ `     D@     `    D 2#c     D #c D #`D P3`D`    `D    ` D c(@D c@D c@`     D @ `     D@     ` 	   DD c8 `#c8    DD c `#cD c 0````  A    c @ `      c@     `     1   D `l`     D ``      /b(:   D ``     D `pD `D ` @   @f   DD `#`lD `DD c #c DD c `@#c D c `    D ``      /bx:   D c `    D c$`  	    /c@:    @6   D b`    D c$`      /c:   D c`     D ``      0`x:   D c 0`	```      c @ `      c@ H    `         0a:T   D''D    ``     D    ``          'c( D c@D c@`     0bX:,   D c`     D c `     0b:   D c`  "   DX    ``     D    ``     D c(`  	   D c`          0cP9   D ``    D #`D @ `  ]   D c ``      0c:   D #c D `l`     D #`lD P3`pDD cc  D c$@D c(@D c,@D c0@D c8@D c<@D c@@D cD@`      0c9   D b`      1`89   D c`      1``9   D b`      1`9   D b`     D c4`      1`9   D c`     D c `    $  1a(   DD cc D c@D c @D c$@D c,@D c0@D c8@D c@@D cD@`     1a9P   D b`     D c`  	   D c`          1b09m   D c`  ;   DD cc  D c,@D c0@D c8@D c@@D cD@`  $   D c ``     D c`    D c 0`````         D `Ě `D c@     1bp8   D b`     D c`      1c 9!   D c`      !b 1c`@   D b`     D c`      1c8   D `؀`     D c8`      2`h8   D `܀`  	   D ```     D `D`j(`0``     D c`      2`8   D ``     D ``     DD ``      2a08   D@ ~    ` 5   DD bb D c@D c@D c@D c @D c$@D c(@D c,@D c0@D c4@D c8@D c<@D c@@D cD@`      2ax8]   D@ D    `    D(ctDD ``     DD` `  㿐'D'HH`      2bP8<   DH#cD cH@    DH#cD cH@    DH#c  㿐'D'HH`      2b8   DH#cD cH@    DH#cD cH@    DH#c  㿐'D'HH`      2b7   DH#cD cH@    DH#cD cH@    DH#c  㿐'D'HH`      2c87   DH#c  㿐'D'HD cH@    D 2cpc7   DH#c  㿐'D'HD cH@    D 2cc7   H`      3` 7   DH#c  㿈'D'HD dЀ`     D d@پ   D'H`  	   H@٠    '    '#dЁ  㿐'D'HD dԐ H @#   D +dځ  㿐'D'HH  ?c@ 
   D`     c   H  ?c@ 
   D`      c        㿐   ?c        㿐    ?c        㿐'DD@          㿐'DD@          㿐'DD @ D `$   $ @5   D d$    @.   D d4    @'   D d8  㿈'DD @ ` %    D@ D@ @ #  DD ``      DDD ` `#  `"8' H    3`H 3`h  3`x@    D @ ` -   D d$    @   DDd4` `Dd5` `  @C    Dd6` `  @:    Dd7` `  @1    $$8'    D @ `    D #d8'    ?'  'D'H'L'''H@ز    ''D @ `     Df   D d8L`c    :@^    `      3`6   ''''''' 3`@    'А   3`@    'D'tԀ`     @f   'p      'ppt `D ``  	   D ``         D !b 3``@b   D  #`'@@ (`8``  '   @@ (`8` @3    `     @@ (`8` @)    `          '     `'   D ``     `         D #@ D ` Д @0    `  H   @,    '`  1   'D ` `  @  @ג   (` @ @ `      `'   ` #    ` @  @ ' @     3aH 5        !b 3a@   @    'x   D `'DD   `#@ (@  @# DD   `#@ (@ @#   D@ D@ @ #  DD ``      DDD ` `#  `"8@ת   'x    !b 3a@ו   @מ    'x   D #@ '؂ `'@ (`8``  @   @ (`8``.     `'쀠`    (@ (`@؂ `#   @ (`8``*   @ (`8``,   @ (`8``-   @ (`8` @/    `     3b5(      쀠`     3bH5   '쀠`    '(`@ Ȓ ,@    'Ԁ`     (@ (`@ @ (`8``*    ' ' L   (`@ @ (`8``-    ' ' <   (`@ @    ''(`@ Ȓ -@֩    '؀`      ؂@@ (`8``     ؂ ` @    '    ؀`      ؂@@ (`8``      '`     ܀@    `    ܀`         3b4   #@@`     3b4   '܀@    D (`   @+ $`"  `'   D@ +d4Ԁ`  	   (`@Ԃ `#Ԁ`     F    `'<   D d$    @`   DDd4` `Dd5` `  @ֶ    Dd6` `  @֭    Dd7` `  @֤    $$8 r   'L`     3`H 3`h! 3c @     /@    `      3c4   D #@ '     @    '    @֞    '`     @     !b 3c @   @   `     @ք    'x &    ``      3`H 3`h!( 4`@     `'|D `| `   @m   D #d8@`   @   'xx  x'D'H'''D @ `    ?'    H'܀` ,   ܀`    ܀`  
    =   ܀` 0    7   'Dd5` `Dd6` `  @    Dd7` `  @    ' !    'Dd6` `Dd7` `  @    '     'Dd7` `'    ?' V   D d8 `쀣@     3`H 3`h!T 4`H@ ?   '䀠`  &   D(` @D@d4`$$@    D(` @D(` @ d$ `#$$    D(` @ d$ '    `'䀠`    D(` @ d$ `'   DD d8#@ `#$8'  p'D'H'LH'H'H`      3`H 3`h!w 4`h@    L`      3`H 3`h!x 4`p@    D d8`     ?'>   D @ ` (      @    3@ L #@ DD ``      D `@   `#@ "     4`x2   D d8?'   D @ `       @Ա    3@ L #@  c `` +   DDDDDD d$@`$`#\DD d(@a$`#`DD d,@b$`#dDD d0@c$`#h$  4`$$(,$0   DD d$@`$`(`DD d(@a$`(` DD d,@b$`(` DD d0@c$` " '쀠`  &   D(` @D@d4`$$@    D(` @D(` @ d$ `#$$    D(` @ d$ '   쀠 '   D d8`     3`H 3`h! 4`@    DDd4`#d$DDd5`#d(DDd6`#d,DDd7` `#d0 A   D d8` <    3`H 3`h! 4`@    D @ `     3`H 3`h! 4a @    D d8`     3`H 3`h! 4`@    L  #@ L   @ @    3@  `D `   @d   DD d8 #d8@ (`0``     c `܀`      c ``     c `   '  㿈'DDD d8 `#d8D @ `    DD ``      3`H 3`h! 4a @ r   DD ` #` Z   D @ ` 9    '쀠`  &   D(` @ d$`     D(` @D(` @ d$ #$$    D(` @D@d4`#$$ '   쀠 '    3`H 3`h! 4aH@ /   D @ `     3`H 3`h! 4a @ !   D d8`     3`H 3`h! 4`@         㿐'D'H'L'P'TD `     H`      3`H 3`h! 4aX@    DH(` @ S   $  DH#`D `D `DL#`DP#`DT#`D `  㿐'D'H'L'P'TD `     H`      3`H 3`h! 4aX@    DH(` @ Sr   $  DH#`D `D `DL#`DP#`DT#`D `  㿐'DD @ @        㿐'DD @ @        㿈'DD ``    D@  ,       'D ``    '@Җ        㿈'DD `` z   D@         'D ``    '@|        㿐'DD `D   X@s   D `XD `\DD `#`D `    @d   D `   ! @]   D a   ! @V   D b   ! @O   DDD d #c##D?#dD(dD d8D d<    @;   D dB    @4   D dH    @-   DDD(dP+dO+$ND dTD(dXD #ddDD(d+dh  㿐'DD@  <   D        㿈'DD@  1       'D `` y   '@   D `` p        㿈'DD@         'D `` _   '@   D `` V        㿈'DD ``     D `@   D d8`     D d8@   D d8D `X`     D `X'쀠`     @ E   @        㿀'DD `'D `'@ (`0`'@ (`0``     `'     `'D d  .@    `     @ Q{     @     4ah /k        㿈'D'H'LH`      4a 4aД  4a@ O   L`      4a 4aД  4a@ B   D c`      '    D ca      4a 4aД  4a@ +   D `DH c@   LD c#@ '  㿐'D'H'LL`     La          4a 4aД  4b@    D c`     D  @     D ` HL@Ч   DL#cDY   D@ ʋ    D ``          㿀@''DD@      '쀠`      @ #@     '#@   㿈'DD `'@ (`0``     `'    '  㿈'D'H'LD c`      ' %   D ca      4a 4aД  4b8@ ɗ   H`  
   D aDH c@>   L`     LDc @ '  㿐'D'H'LL`     La          4a 4aД  4b@ h   D a HL@   DL#c  㿀@''DD@      '쀠`      @ #@     '#@   㿈'DD a'@ (`0``     `'    '  㿈'D'HD ``     D `@R   D `H`  6   DH@3    $  '@ (`8``  '   @ (`8` @    `     @ (`8` 4bX @    `  
   $  4bh|g    *+@  `'     㿐'D'H'LH`      4a 4aД!0 4b@    L`     4a 4aД!1 4b@    D ``     DD dHL 4b`@π    	   D dH L@ OX   H   㿐'DD d8`     D!.@ P   $$8DD d8!.       㿈'D'H'LD d `     ' &   D d a      4a 4aД!D 4b@ {   H`  
   D bDH d @"   L`     LDd  @  '  㿈'D /HD'H``      '    ' d  㿐'DD d`     D d`     4a 4aД!T 4b@ 8   D d`  @     㿐'D'H'LL`     La          4a 4aД![ 4c @    D b HL@   DL#d   㿐'D'HDdX``      4a 4aД!f 4cX@    D (dXH`     $\D@H@ #  `#     D d\   @Κ        㿈'D'HDdX``     4a 4aД!n 4cx@    D(dXH`  	   H @ ' `'       @s   DDD d\#@ (` @(` @(`D d`#@ #@+     T @$dT  x'D'HD dT' c `̀`     ' 6   DdX``  )   H`  	   H @ ' `'       @3   D d\#@ (` @(` @(`D d`#@ #@      @' c `쀣@@  '܁  㿈'D'HH`      '    D d< H @   D +dN'  㿈'D'HH`      '    D dB H @   D +dO'  㿈'D'HH`      '    D dH H @   D +dP'  㿐'D'H'LH`  	   D dh H  @ M   L`  	   D d L  @ M        㿈'DDdN``     D d<'    '   㿈'DDdO``     D dB'    '   㿈'DDdP``     D dH'    '   㿐'DDD a#aD?#aD  ! @   D(aDD?#a?#!D aĐ    (@ͺ   DD a#a  㿐'DDD a#aD?#aD  ! @ͦ   D(aDD?#a?#!D aĐ    (@͗   DD a#a  㿈'D'D a쀣@    D(` @ a]   D(` @ a `'   D a  㿈'D'D a쀣@    D(` @ a]d   D(` @ a `'   D a  㿐'DDa``     D@  )   D +aD a   㿈'D c `Ѐa    '    D a`  	   D a`         '     '  㿈'DDD c#cD cD a    D?#c    'D a쀣@    'D(` @ a  `耣@ |   D(` @(`! @ `D @  ~    ``  e   D c`$    D(`@ @  ` 4c @  `H        b   D?#c ]   D c`     D(`@ @  ` 4c @  `   	 J   DD c(` @D(` @(`! @ `"DD c(` @D(`@ @  `#"#"D(`@ @  ` 4c @  `H           DD c `#cDD c `#c `'~    `'r   D c`     D?#c  㿀'D'H'D c쀣@ [   HD(` @ a   @ @    `  H   HD(` @ a  `@    `  :   HD(` @ a  `@    `  ,   H `'H ``      4c'D(` @ a `'D(` @ a ``      4c'@    `      '     `'   '  㿐'DD?'@ D `D `DDD `,'`(' $DDD `8'`4' 0D `D `D(`D(` D(`!D(`"  㿐'DD?'@ D `D `DDD `,'`(' $DDD `8'`4' 0D `D `D(`D(` D(`!D(`"  㿐'DD```      i   D ``     D `@   D ``     D `@   D `$`     D `$@˼   D `(`     D `(@˳   D `,`     D `,@˪   D `0`     D `0@ˡ   D `4`     D `4@˘   D `8`     D `8@ˏ   D `D ``  	    "`D @ `@    D ``  	    "`D @ `@    D(`D?#`<  㿐'DD```      i   D ``     D `@[   D ``     D `@R   D `$`     D `$@I   D `(`     D `(@@   D `,`     D `,@7   D `0`     D `0@.   D `4`     D `4@%   D `8`     D `8@   D `D ``  	    "`D @ `@    D ``  	    "`D @ `@    D(`D?#`<  p'D'H'L''''D```      4c(   H`  	   H@ (`8``      4cL(   D +`DL#@ H@ (`8` @    `     H `'H    5H`P 
@    `  
   D +`"H `
'H     5H`` @    `  	   D(`"H `'H     5`hL(r   H  @C    '쀠`      5`L(c   DH#@ ` @ J   $ DH#@ H @   DH#@ @(@ 'HH@ (`8` @ʋ    `     H `'H   H@ (`8``m     H@@ (`8``      5aPL(#   D #`H `'H@ /H `'H(`8`H @    '쀠`      5aL(   DH#@# DD ` ` @ Jn   $ DD `H`@ɝ   DD `` (@  `'HH@ (`8``  /   H@ (`8` @%    `  $   H@ (`8``i    D +`     H@ (`8``s    D +`!     5b8L'   H `'H   D` ``     `'D`!``     `'DDܘ `    @ʥ   $ D ``  	    5bL'   DD `   @ʓ   $ ܀`      5c L'x        5chL'q   H@ (`8` @ɴ    `     H `'H   H@ (`8``     H@ (`8``    H@ (`8``
    H@ @  `#@ /H@ (`8``     H@ (`8``    H@ (`8``
         5cL'*   H@ @  `#@ /(`8`H @    '쀠`      5cL'   'H#@'Ԁ`     Ԃ ` @ Ix   'H@ȩ   Ԃ@(@ (`8``p    D#`$ B   (`8``v    D#`( 7   (`8``i    D#`, ,   (`8``h    D#`0 !   (`8``o    D#`4    (`8``d    D#`8    (`8` 6`( L&    `'H;   D +`  'D'H'LH'D```          6` 6`! 6`@    D ``     6` 6`! 6`@ x   D `@     @Ȋ   DD`"+`@DD#\ #`` L    @z    '쀠`  -   쀠     c ``  
    c ``        DD 6` ` &y       쀠    DD 6a@ ` &8    u    P#\ `H#` P#d `#h #l a#p P#t ah#x  #| a#  #DHL  c@     ' c@ (`8``     D c `H `H@ (`8``     D `H `L `@ (`8``     D ` `P a@ (`8``     D a `T ah@ (`8``     D ah `X a@ (`8``     D a `\DD` `DD `@   㿀'D'H'LD`     H`     ?'.   D  "@Ǻ   H@ (`8``    H@ (`8``)   H@ (`8` @    `     H `'H   H@ (`8``)        H@ (`8``"    D @ `    ?'    H `'HH@ (`8``"    ?H@@ (`8``\ :   ?H@@ (`8``\ 1   DD @ (` @ b'耠`~    ?'    DD @ (` @@H@ +`DD @ (` @DD @ (` @ b `#"H@ (`8``        DD @ (` @ b'DD @ (` @@(`D @ (`D@ `  ,L    `     ?'    DD @ (` @#bDD @ (` @ #bDD @  `#@ H `'HH 6a@     'HH`     ?' `   H@ (`8``,2   H `'H-   DD @ (` @H   @   $"H@    ?' ?   'HDD @ (` @ #bDD @  `#@ H 6a@     'HH`     ?' "   H@ (`8``,   H `'H   H@ (`8``)    H `'HL`     LH#@ D @ '  㼀'D'H'L'P'T'X'''D@ (`8``$    ?'K   D `'DD@ (`8` @_    `  D   D (@     '܀`     ?'/   D#@'Ԁ`     Ԁ`        ?'    D@   Ԃ @(܂ `'Dؐ D l    '`     ?'   'D    /D@ (`8` 'D `'DH`     HD#@ (`8``  g   Ѐ`	    Ѐ`         ?'   `@    ?'   Л(`\@ @ 'Л(`\@ `'̀`  	   X@         6` 6`"^ 6a@    Ȁ`  	   X@         6` 6`"_ 6a@    ̂#@'Ԛ P@    ?'   T̂@L @M   'p    6 a@a    `     `    ?'m   'Ѐ`	    Ѐ`         ?']   `@    ?'T   Л(`\@ @ 'Л(`\@ `'̀`  	   X@         6` 6`"n 6a@ K   Ȁ`  	   X@         6` 6`"o 6a@ 7   'Ȁ@
   T@@ ` @1    `     P Ā@    ?'     L T @ * `"  `'    6 a@    `     `    ?'    'Ѐ`	    Ѐ`         ?'    `@    ?'    Л(`\@ @ 'Л(`\@ `'̀`  	   X@         6` 6`" 6a@    Ȁ`  	   X@         6` 6`" 6a@    `    `        ?'     `'' a'''Ȁ@ e   P Ā@    ?' j   #@쀣@    @  L@  T  `" @ *  "@    T@ @    `     @  L@  T  `" @ *  "@    PĂ#@ 耣@    ?' '   LĂ@ @   @'@'   ?'    P@    ?'    LĂ@(@ '  p'D'H'L'P'T'XT'X'X\@'X`     T`     ?'    \`    ?'    @ (`8``      $@     '䀠`  E   @ (`8``     ܚ @    ?'       @  `#   (@ `"    (@   'X@
    @ (`8` @    `     @ (`8``,        (@    ' p   #@'쀠`     #@ @    ?' \   @9    @''#@L#\P#`  DH    '쀠    ?' 7   @''m   ܚ @    ?' %   (@   'X@
    @ (`8` @Õ    `     @ (`8``,        (@    '؁  8'D'H'L'P'T'X\`     d`     l`     t`     |`     `          6` 6`" 6a@    \`     X(@ d`     `(@ l`     h(@ t`     p(@ |`     x(@ `     (@ 'D `$`  H   D\#\HLPT`$X    '쀠`  7   D'D `$'D `$`      6bh'D `('D `(`      6bh'D `,'D `,`      6bh' 6bpL @     \`     X(@ ?'D `(`  H   Dd#\HLPT`(`p    '쀠`  7   D'D `$'D `$`      6bh'D `('D `(`      6bh'D `,'D `,`      6bh' 6bL @     d`     `(@ ?'D `,`  H   Dl#\HLPT`,h%    '쀠`  7   D'D `$'D `$`      6bh'D `('D `(`      6bh'D `,'D `,`      6bh' 6c`L @  @   l`     h(@ ?'D `0`  0   Dt#\HLPT`0p    '쀠`     D'D `0'D `0`      6bh' 6cL @     t`     p(@ ?'D `4`  0   D|#\HLPT`4x    '쀠`     D'D `4'D `4`      6bh' 7`PL @    |`     x(@ ?'D `8`  0   D#\HLPT`8t    '쀠`     D'D `8'D `8`      6bh' 7`L @    `     (@ ?'   㿀'D @    D `h  @        ' @    '@^    @     @    D `t  @        ' @    ' i    @     @ ȹ   D `  @        ' @ Ⱥ   ' H    @ ȳ    @    D `  @        ' @    ' '    @    D `\D ``D  c#@ D `dD?#`D #`D `'䀠` $   D(` @ ` `'   D ` @ Ȗ   'D `t @ s   'D `h @ l   '@        㿀'D @ E   D `h  @ N       ' @ >   '@    @ 6    @ *   D `t  @ 3       ' @ #   ' i    @     @    D `  @ +       ' @    ' H    @     @ )   D `  @ 2       ' @ "   ' '    @    D `\D ``D  c#@ D `dD?#`D #`D `'䀠` $   D(` @ ` `'   D ` @    'D `t @    'D `h @    '@,        x'D @    D `\`     D `\@5   D ```     D ``@,   D `#@ @       'D `#@ @         @     ``      @      @ '܀`        @   #@   @          D ``     D `@       'D ` @    ' 
   D ` @        'D ` @ g   ' 
   D ` @ _       'D `t @ :   ' 
   D `t @ 2       'D `h @ )   '@   D `h @          x'D @ c   D `\`     D `\@   D ```     D ``@   D `#@ @ P      'D `#@ @ P        @ U    ``      @ q     @ '܀`        @u   #@   @ K         D ``     D `@J       'D ` @    ' 
   D ` @        'D ` @    ' 
   D ` @ ƾ       'D `t @    ' 
   D `t @        'D `h @    '@   D `h @         㿀'D'H'LH`  	   H@ (`8``      7a8L    7Ha @    `     D #`     7Ha @    `     D #`     7aL   H `'HH@ (`8` @i    `      7aL   H  @     '쀠`      7bL   H#@'D ` @ >   $ \D `\H@   D `\@(@  `'HH@ (`8``q     7b`L[   H `'H@ /H ` 'H(`8`  @ y    '쀠`      7bL@   (@ H #x    `      7cL0   DH@          㿐'D'H'LD `d`     D ``@D   DL `dL`     DL ` @ >   $ `D ``HL@   D ``L@(@     D ``  x'D'H'L'P''L'@ (`8``     @ (`8` @/    `      `'   @ (`8` @    `  -     
@    '䀠`  
     ?c@         7c`P   '@ (`8` @    `      `'    7cP   @ (`8``     @ (`8``,        ' E   @ (`8``- 9    `'@ (`8` @{    `  $     
@t    '`       ?c@ 	   䀣@         7c`PZ   '     7cPQ        7cPJ   @    7ނH @ u    `'   @ (`8` @|    `      `'   @ (`8``     @ (`8``,     7cP   @ (`8``,     `'쀠`     @ (`8``          㿐'D'H'L'PH`     D `hD LP       H`     6` 6`# 8`(@    D `tD LP        p'D'H 7LH`    D `t'    D `h''#@@       #@@       L#@   @       #@@       ܐ  @ +    ``     '     '؁  x'D'H @ *   D `#@ @ :      'D `#@ @         @     ``      @ G     @ H@+    `      '    #@   @          '܁  㿈'D'H'LH@J    '쀠`     쀠`	         8`HL4   D#`  㿈'D'H'L `@f     K   'HLN   @ *    'D    ``  	   D `  @ *   D `  @         p'D'H'H 8`@    '`      8`H    ( @    ` U    `'(`8``
   (`8``#    8 ` @    `     D ``      8a    D ` E   $     8 aH @    `      8aPH    @   '       '@   '@   ' `     ( @R    `     `'(`8``
   (`8``#    8 aH @    `  $   @ x    ``     D ``      6` 6`$< 8a@ G   D#`   D @ 7       8 aؔ @    `      `   5       8 a 	@t    `      `	          8 a @_    `      `    ~    8 a 	@K    `      `	 @    $ i    8 b @6    `  "    `    
@    '܀`c 
    $c@         8bH   #@ >    5 `` @    `      5 `P 
@     `  
    |        8 ` @    `      8b       8bH      쀠`      6` 6`$W 8c(@ y   @ ޔ    ``     D ``      6` 6`$Y 8a@ c   D#`    D @ S   @   D@ 3        㾐'D !  8c8I         8cP 8cE   D C        㿀 a @ `      a @ ' #    a' @h   '@         '@`   '@)    @  a @     a @ '  x'D'H'L @    D `#@ @       'D `#@ @         @     ``  "    @      @  HL9    ' ``     '    #@   @          '؁  㿀'D @    D @        ' @    '@    @    D `D `  㿀'D @ ߳   D @ ߾       ' @ ߮   '@    @ ߦ   D `D `  x'D @    #@D@       '#@D@         @     ``  &    @      @ '܀`        @   #@   @          'D@ s   '@L   D@ l        x'D @ |   #@D@ }      '#@D@         @ ߄    ``  &    @ ߠ     @ '܀`        @I   #@   @ z         'D@ *   '@   D@ #        x'D'H'L @ 1   L`    D ``     D `@      H@    `     D `' P   #@D@       '#@D@         @     ``  6    @ :     @  @     `L@     @ +     @  @     H @_    `      @      @ '    #@   @          '܁  㿀'D 'L7H'?'D ``     ' @   L`    D ` @ 'D ` `'    L`    D ` `'D ` `'     9` LJ   '耣@     @@@ (`0`H(`0`@     '     `'   '  x'D @ n   #@D@ o      'D `D `#`#@D@ l      ܂  @ q    ``      @ ލ     @  ``  (    @ ރ     @  @ }     @ $  @ v     @  @     ``     @ h     @ D `#`     @ ]     @  @ W     @ $  ' @ N     @  ` 9``@K    '耠`  I   䀠` E    @ 9     @ (` @ @ 0     @  @     `D    $  @      @ (` @ ``      @      @  @ ۽     9`h {    `'   9``@    '   䀠`     @      @  @ ۝     9` \    @      @  @ s    ``     @      @ (` @D `#` @      @  ``      @ ݿ     @  `@X    @ ݶ     @  `#@   @ ݚ      	     㿐'D'HD bP @ ^   D @ D `D b<D #b8DD(bB3b@DH#bLD bTD bXD `DDD(`+`\+ DDD(a+a+!,D b,D b0D(b4DD bd#b`D b\D bD    @        㿐'D'HD bP @    D @ D `D b<D #b8DD(bB3b@DH#bLD bTD bXD `DDD(`+`\+ DDD(a+a+!,D b,D b0D(b4DD bd#b`D b\D bD    @        㿐'DD bT`     D bT@   D b\`     D b\@   D b\DD b`#bdD b0`     D b0@   D b0  㿐'DD bT`     D bT@   D b\`     D b\@   D b\DD b`#bdD b0`     D b0@h   D b0  㿐'D 'L/HDD bdb`# `     9a =   DL `b`  @    L@    DD b\b`   9a8 @   DD b` `#b`DD b`  \ H+  `"   㿐'D'H'LH@ (`8``     H   @ (`8``#  D L        㾰'D'H'L'PDD bdb`# ' J' c ``     Pe 
       Pc        P'H     c ``     %'H    #'HH' (` H@      `'P`      6` 6`%U 9a@@    H`      6` 6`%V 9aH@    D b`'D c ``  
     	cD@       Dh   쀣@    '@@b     " '@@'D bd@'DD b\@ 6   $"\D#bdDD bdb`# 'D b``  J     @    'ԂԐ @}    'D'<DbB`     '8D'4Db@(`0`'0D b,`     9aX',     6bh',,#\ c `#` ` `#d `#h#l 9a`#p4 b\ 9ax08 9a@   <#b`P   9aHP@    'LPD    '䀣@    DD bdb`# `     6` 6`%r 9a@    L܂@@ ` @    `     L܂@@ (`8`D        L܂@@ ``  $   ܚ `䀣@    L܂@`` @    `  
   D 9a       D 9a       L܂@@ ` 9b  @{    `     D \Q   L܂@@ (`8`D F    r   L܂@@ ` @    `     L܂@@ (`8`D -    Y   L܂@@ `` 
   D 9bX    I   L܂@@ ``
 
   D 9bH    9   L܂@@ ``	 
   D 9b 8    )   D \   D x   PL܂@@ `   9b( @   P(`8`D    Q(`8`D    ܂ `'   D "   D )   DD bdb`# `     6` 6`% 9b0@    DD b\b` (@   㿈'D'HD b``     H`     H @ ' 0   D b` `D bd@    DD b` `#bdDDD b\bd@ 4b   $"\H`     HD b` `#@ DD b\b`  ;+@ DD b\b` (`D b\'  㿈'DD b8` 
   D @  :    ' 3   D b8`    D bL ``      6` 6`% 9bX@    D bL `'    D b8` 	   D b8`        D bP @      @ '    '  `'D /H/H``     D bT`     D bT@   D bTD bXD b8`    D #b8DbB``    D bL ``     D bL `'Z   D b8`    D #b8 /"PD@D#@bL@       $  D b8`    ``     D#@bL@ v      D bP  @ z    ``     D bP#@   @ ـ      D#@bL@ Z      D bP  @ ^    ``  ?   DbB`D bP @ v     @  @     `  "   D bP @ g     @ DDb@(`0` ",      ``     D bP @ Q     @ '    D bP#@   @ 2         D #b8 /"PD@D#@bL@       $  D b8`    ``     D#@bL@       D bP  @     ``     D bP#@   @       D#@bL@       D bP  @     ``  i   DbB`D bP @      @  @     `  L   D bP @      @ DDb@(`0` ", y    ``  6   D bP @      @  @ |     c `䀣@ %   Db4``     D bP @ س     @ D `    ``         D bP @ ؠ     @ ' (   D bP#@   @ ؁         D'Db4``      '     '#b8' 	   D 9bhb8   '́  㿐'D /HD bT`     D bT@   H``     D b\`     D b\@   D b\DD bd#b`D bTD bXD #b8  x'D'HH`     HD @ bD#  (` @(` @(`HD `bH#  #@     '       @F   D bD#@ (` @(` @(`D bH#@ #@      'D     @ #@''܀`     'ܰ   㿐'D'H'LDDD bXL@"T @   $"TD bT`      6` 6`&* 9b@ K   DD bTbX  HL@   DD bXL@#"X  㿐'D'HHD bX'@ D bT   P'D'H'L @ ׿   D @        'Ԃ @ ׺   '@*    @ ײ    @ צ   D `  @ ׯ       'Ԃ @ ן   'T    @ ט    @ ׌   D `  @ ו       'Ԃ @ ׅ   '3    @ ~   D `    @   'H@ !    䀣@ d   'H@ w     @        ``  	   DD `  `#`  G   H@ `     @  `` ܔ!      '܀`  4   "h@   'L    
   '@   '    ''H@ 7     @ #@ @ 3b@`+bB#`D `  @ C       `'   'H@     䀣@ _   'H@      @       ``      G   H@      @  `` ܔ!  ̛    '܀`  4   "h@~   'La    
   '@u   ' u   ''H@      @ #@ @ 3b@`+bB#`D `  @        `'   D' $@E   ' 9b    
   '@;   ' ;   #` ' c ``     
' c ``     ' c ``     'D' c' c `' c ``      d'`@     `    'D ` @    'D ` @    'D@    '@        P'D'H'L @ /   D @ :       'Ԃ @ *   '@    @ "    @    D `  @        'Ԃ @    'T    @     @    D `  @        'Ԃ @    '3    @    D `    @   'H@     䀣@ d   'H@      @       ``  	   DD `  `#`  G   H@      @  `` ܔ!  q    '܀`  4   "h@T   'L7    
   '@K   '    ''H@      @ #@ @ 3b@`+bB#`D `  @ ճ       `'   'H@ &    䀣@ _   'H@ |     @   %    ``      G   H@ j     @  `` ܔ!      '܀`  4   "h@   'L    
   '@   ' u   ''H@ A     @ #@ @ 3b@`+bB#`D `  @ M       `'   D' $@   ' 9b    
   '@   ' ;   #` ' c ``     
' c ``     ' c ``     'D' c' c `' c ``      d'`@ "    `    'D ` @ q   'D ` @ j   'D@ e   '@&        X'D @    #@D@       '#@D@         @     ``      @      @ '̀`     u   @&   #@   @          D `#@ @ Զ      'D `#@ @ Է      ؂  @ Ժ    ``      @      @ 'Ȁ`     =   @   #@   @ Ԫ         D `#@ @ ~      'D `#@ @       Ђ  @ Ԃ    ``      @ ԕ     @ 'Ā`        @   #@   @ r         D `'`     (   @       'D ` @ ў   ' 
   D ` @ і       'D ` @ э   ' 
   D ` @ х       'D@ ~   '@?   D@ w        X'D @    #@D@       '#@D@         @     ``      @      @ '̀`        @<   #@   @          D `#@ @       'D `#@ @       ؂  @     ``      @      @ 'Ȁ`     S   @   #@   @          D `#@ @ Ӕ      'D `#@ @ ӕ      Ђ  @ Ә    ``      @ ӫ     @ 'Ā`        @   #@   @ ӈ         D `'`     >   @       'D ` @ д   ' 
   D ` @ Ь       'D ` @ У   ' 
   D ` @ Л       'D@ Д   '@U   D@ Ѝ        'DD ` `` @   D @  ``Db@(`0`DbB`          c ``  
    c ``     !   Dp @   (   DbB`       Db@(`0`p$  9b   Xn   $ X        x'D'H'L'PP`      6` 6`& 9c @    P@     ``     ' '   P @ '    '耠`      6` 6`& 9c@    L      #\DH a L@ B   '  h'D'H'L'P /TP b8` `?/P    'T``  K   @ ϯ    ``  C   P      '耠`  $   "DP@@ <+    @ $  `$ DHP   @ <    P     DH ` P@ A       Pb4``      '     'DLP  @        ``     P     '耠`     PbB`` \   H @ ?n   PDP@ >   $"<"<`      9c 	,   P @   پ   P b,`     P#\Pb@(`0`#`Db< b<  cP @ -    p   P b,`     6` 6`& 9c`@    P#\Pb@(`0`#`P b0#dDb< b<  c@P @ -    J   PbB``     6` 6`& 9c@    "DP@@ ;v    @ $  `$ DHP   @ ;i    P     DH ` P@ A5       H @ >   Pb4``      '     'DLP  @         㿈'D'H'L'PP 9 `c @    `     P #b,PP ` `#`' D   P b,`     ' <   PbB``    P ``     P 9 `c@.    `         ' "   P #b,P `PPP(`+`\+ PPP(a+a+!,P(b4P `   DHLP     '  0'D@     ``  b   D@ H    '	?耠`  	    9c @  `蕢H?D ` @ 4    '?`  	    9c @  `H?D ` @      '?؀`  	    9c @  `ؕH?ؙH?D@ 
    '?Ȁ`  	    9c @  `șH?ȑL葢?@ :~    D `Ė    @ :t    D `     ``  b   D@     '?`  	    9c @  `H?D ` @     '?`  	    9c @  `H?D ` @ г    '?`  	    9c @  `H?H?D@ Н    '?`  	    9c @  `H?L?@ :    D `         p'D'H @ 5   /D `#@ @ 3      'D `#@ @ 4        @ 7    ``      @ J     @  @ H@     /    #@   @ )         D `#@ @       '``  .   D `#@ @       Ԃ  @     ``      @      @  @ H@     /    #@   @          ``     @ 9    H    H  /    ``     DD `  `#`   `'D'H'L'P'T @ ϝ   P @ 'PH#b8L `#@ @ ϖ      L `#@ @ Ϙ      ܘP#@   @       'L `#@ @ τ      ؂  @ χ    ``  #    @ Ϛ     @ P@     6` 6`'T 9c@ p   L `'КЂ#@  @ Ͻ       \   L `#@ @ E      L `#@ @ G      ĘP#@   @ σ      'L `#@ @ 3        @ 6    ``          6` 6`'[ 9c@ '    @ >     @ P@     6` 6`'\ 9c@    L `'ԚԂ#@  @ a      PL @    L   T`     T @ <4   L        x'D'HH ` @     H `@    H ` @ I    ``     H ` @ J     @ '@ 8}     @  )    ``     D 
H         N    '耠`      `X @ `      c ``  	    9c@o    `X @ D H        D@ ;W   $"<"<`      :`8    c ``     @ @     bB`   ,    b@(`0` :`   @7    @      bB``    #\b@(`0`#`Db< b<  c @ )        bB``     6` 6`' 9c@ 7   b@(`0`#\Db< b<@ *   H ` @ Ω   H `  @    .        x'D'H'LH@ A    'H@ A    'H@ @    'L'R    'D@ D'   '䀠`     䀠`     6` 6`' :`@    @ 7     @  ?    ``     D 
       耠` T   @ <D    `  "    b0`     @ ;    "0@         b0@   @ ;   $"0    @ ;   $"0bB``    f   "D@@ 7F    @ $  `$ D   @ 79         D ` @ =    6   耠`    耠`         c ``     @ C$     :`    D 
       耠`    D 
        :a@O   DT        H'D'H'LH@ @5    'L'D@ C`   'H@ @<    '@     ``  b   @ E    '	?Ѐ`  	    :a @  `ЕH? ` @ 1    '?Ȁ`  	    :a @  `ȕH? ` @     '?`  	    :a @  `H?H?@     '?`  	    :a @  `H?LБ?@ 6{     `    @ 6q     @      ``     D 
    B   쀠`     <   쀠`    D 
    /   쀠`    H@ ?    '@$     :aܔ     c ``     @ B<     :a    D 
   D        'D'H'LH@ ?s    'H@ ?\    'H@ ?N    'L'    'D@ B}   ''䀠`     6` 6`( :a@ @   @ 5     @  ֘    ``     D 
k      耠`   H @ ?J   '          ''ȃ(` @ ``     ȃ(` @ `    '̀`  	    ``         Ȃ `'   ̀` L    `` G   @ ``  &    ``  !    ``@    ` 2    @ #    b@(`0` :b          c ``     ``      ``  	    ``      Z   @    'ȃ(` @ `@    ' @    'b@(`0`' b,`     :bh'     6bh' `#\ `' ``      6bh'#` `' ``      6bh'#d `' ``      6bh'#h :bp@    A   @ Ȍ   'ȃ(` @ `@ Ȅ   ' @ ԓ   '@ ``      :b'     :b'b@(`0`' b,`     :bh'     6bh'#\ `#` :b@    `#` ``  
    `̐ ` P@ #    ``  
    `\̐ ` P@ #    ``  
    `̐ ` @ #    ``  
    a,̐ ` @ #~    ``  
    a̐ ` @@ #q    ``  
    a̐ ` @@ #d   @ +b4b4``     D    `  	   D    ̀`      ``  
   @ ``              `     Ѐo          D ` @ 9       Ѐ`          @ Ǭ     u   D         耠` #       'Ѐ`          @ Ǉ     P   D         耠` 8       'Ѐ`     w     @ b     +   @ 3    ``     Ѐ`     D D    |   D S    s   耠` ]   H@ =
    ''`    `    ` 5   `  1    8   `    `     .   @     ``     D     ;   D     2   D 
    )   D          @8     :c Ĕ         耠`    D 
        :ch    D        㿈'DD b8`    '     c `䀠`    '     '  8'D @ H   #@D@ I      '#@D@ L        @ O    `` '    @ b     @  b8`     @ X     @  `'܂ @ P     @ '؂ @ I     @ 'Ԃ @ B     @ 'Ђ @ ;     @ `(`8``      @ /     @  `'    '̂ @ $     @ `\(`8``      @      @  `\'    'Ȃ @      @ `(`8``      @      @  `'    'Ă @      @ a,(`8``      @      @  a,'    ' @      @ a(`8``      @      @  a'    ' @      @ a(`8``      @ ȼ     @  a'    ' @ ȱ     @     `      @ ȥ     @       '    '#\#`#d#h#l b8 ` b,'    ;    @ Ȁ     @    q    `  -    @ r     @  ` @ k     @  @ e     @  @ _     @    P    #\#`#d#h#l b8  ,       #@   @ 5           p'D @    '   @   D `#@ @       'D `#@ @       ؂  @     ``  !    @      @  @ '@ U    ``         #@   @            P'D'H @ Ƿ    @ ǳ   H `#@ @ ǲ      'H `#@ @ ǳ      ܂  @ Ƕ    ``  f   '#@   @ ǵ       @ ǿ     @ 'b@(`0`bB`D  $    `  A    c ``     b@(`0`'bB``     :c'     :c' :c@@   #\#`#d#h#l ` 	     :cȚ     H `'ԚԂ#@  @ ǰ      H @ $   '     㾈'DD@     `      '0   
    ' $@~   ',,D       '((,@t   '((@=   ,' c ``      c ``  
    c ``          :c@       /       ` @ "    `     '$$`     $   $@8    '0S      @     @    ' c ``  Z   ̐ @    '<D@ "    ` @  /;;``     4#@D@ v      4 @      @ @          D@     @   ;`@ @p    ` @    '  ` @     `     ;`P'     ;`X'@<< `#\$  ;`h  K   @ <    '䀠`      ;`~    c@     ``      c@       @ <   p   ؐ   @   ?'@ /K    'Ѐ`    @ <f    '<<@     ;`< G   @ =    c ``     ؐ   @    ` `  Q   @ L   '@ H    `     ;`P'     ;`X'D@ f   'D@ b    `     ;a'     ;a'#@ (` @(` @(`Ă#@ #@x     ' ;a @  `#\#`$  ;a ?KW    5   #@ (` @(` @(`Ă#@ #@O     ' ;a @  `? ' ` `     ;a'     ;a'$  ;aX  ` K"   ?   '`     }   @   '00  㿐'D'H'LDH#`DL#`D ``      ;a ;a r ;a@    D ``      ;a ;a s ;b@ q   DHL@      @ @(` @    $  DL(` @    $ DH(` @ 
   $ D `D `  㿐'D'H'LDH#`DL#`D ``      ;a ;a r ;a@ 7   D ``      ;a ;a s ;b@ )   DHL@      @ @(` @    $  DL(` @    $ DH(` @    $ D `D `  㿀'D'D `耣@ 2   'D `쀣@ &   D@ @    '```      @ `      ;a ;a  ;b@     @ @	    `'    `'   D @ @   D `@   D `@   D ``     D `@        㿀'D'D `耣@ 2   'D `쀣@ &   D@     '```      @ `      ;a ;a  ;b@     @ @    `'    `'   D @ @   D `@   D `@   D ``     D `@        㿈'D'H'L 'T'X/PD `H@     ;a ;a  ;b@@ N   D `L@     ;a ;a  ;bh@ ?   X`     T@$    'XX`      W   DHL@ y    ' @ `      ;a ;a  ;b@    DH(` @DH(` @ @  `" X#`P``     X ` @ |   $   @ TX@    @ X@(@     T#@ P+`DL(` @ @ X@ 	   DL(` @X#@    'T'X'D'H'L'PT'?c @   P@   '  @     ;b   ?c @DHL  L        㿈'D''D `耣@    D(` @ @ @' `'   D `@'D `@       p'D'HD    ''D `䀣@    D `#`DDD ``@    $ D `''D `耣@ [   ''D `쀣@ G   D@ Т    'D(` @ @ ' ``      @ `@    `@'Ђ `'D(` @ @ Ѐ@     `'܀@        +   `" ؂ `'    `'      
+   `"  `'   (@ H`     HD `#@#  D `    a @ `         a #@ 'T a  	a1#@  a ` a a @ (` @    $  !  ;b         ;c         ;cX@    '쀠`      ;c`    h  @    `     T `'Th(`8``#       h(`8` @    `      ;cT        h\   @   'd\`     \@ (`8` @    `      ;cT        \@ (`8``     \@ (`8` @    `     \ `'\   \@ (`8``      ;c <`   <`@ E   \'X\@ (`8``     \@ (`8``
    \@ (`8``    \ `'\   \(@  K   'PPd#@ PX   $  a a` @ @     <`    ad @ @  1    '` a`(` @ @ `     ` ` a  @ @y    '`    a`(` @P#@  a a ` `#`-   @        㿐'D'HD H@V       㿈'D aD @     ' a(` @ @ `  $    a(` @ @  @ D@     a(` @ @ '     ` a  @ @     '   '  㿈'DD`      <`x      D@           '쀠`      `'    '   㿐'DD@ `/` D @ `(`@ D @ `@    㿈'D'HD`      <` <`T   H`      <` <`J   K   ' a @ 쀣@ L    a(` @ @ `  =    a(` @ @  `D@ C    `  .   H a(` @ @  @ 8`*  H@ a(` @ @  @ 8`?@*  H@ a(` @ @  @ ?@*  '     `'   '  㿀 a @ `  !    a @ @    @         ' a @   @    '耠`     '    ?'  㿈 a @ `          a @ ' a @   ` a@   @$        ` <` @    '쀠`      K   @    @G         @    <    @    a @ `      a#@ #`#`#`#`#`#`#`#` ̂'̂ //՚  ` @    a @ `      a#@  "c@        㿈 cc``     '    S    '쀠`     K    `        쀠`v     c c ` `#` c$  <``E    ~   쀠`V     c ``  	    c c ` #` c$  <a`Ew    c   쀠`d     c c ` `#` c$  <a8`Eb    N   쀠`D     c ``  	    c c ` #` c$  <aX`EG    3   쀠`p     c @    $  <axE7    #   쀠`P     c  @    $  <aE'       쀠`? 	   $  <aE       S    '    '  h b b@  @ @ b @ @'@ )7       @5    c ``  N     2@    `  E    a@ ]     b  @ #@ (` @(` @(` b  `#@ #@     ' <c@ @  ` b#\ b @ #` b @ #d b @ #h b @ #l b @ #p$  <b?@ D        㿐'DD ` `	    D 
#` D ` `    D #`  c ``    DD$  <cH @   D        㿀 @ 
   #@ a@ 
      '#@ a@         @     ``  ;    @ "     @  ``  '    @      @  ` @ ,    @      @  ` @      @  `( @ 	    @      @  `0 @    #@   @            㿀'D'H  <c`H@    @    'D+@ D `  @F    `   x @ ̏   #@ a@ ̏      '#@ a@ ̑      ܂  @ ̔    ``  s    @ ̧     @ ' `$`  ]    ``   V   ' `( @ ̥    ``      `( @ ̦     @ ' `( @ ̮        a@ ̍    ``      a@ ̏     @ '#`#  a@ ̓   䀠`      c ``     @ @     $  <ch   C    b b @  `#@ @  $   #@   @ .           㿈'D'H'LL' ` `$ ` `0  @ e   \        h'D'D#@@       'D`(`0`0`/D`/ `'@  <c 
@w    `
'@`       @'@0``       @'@0``       @'@0``       @'@  <c @4    `'D ` #`$D `D ` ` `#`@ '       @    `\ b( @ D(` @(` #@     @' `\ b( @ D(` @(` #@     (` @(` @(` @' А b@@    ؂ @' А b@@    'D `ؐ   @   DD ` `#` b D `#\  ` %b dD @ ,        8 @     @ 	    @ ˌ    @ ˈ   c'@ &    А   @       ``       b0 b b@  @ @ b @ @' b @ Ȃ  ?      #@ a@       '#@ a@         @     `` 4    @      @ 'ܚ `0#@ @ 4      'ܚ `0#@ @ 5        @ 8    ``        #@   @ 7      ' @ ?     @ ' `К#@ (` @(` @(` `Ԃ#@ #@     '̀`  	   Ȁ@    '̀`      `  <c @  `HH#`    ܘ `0'#@  @        ` #` `\ b( @ ؛(` @(`     `  <c @  `HH#`    '#@   @ >      #@ a@          @     ``     #@ a@       '؂ @ ,     @ $  ` ` `#` ``  	    ``     (    c ``     @ @ m    $  <c A>   .    b b @  `#@  a a @  #@ @        @      @  `(ؐ  @ ʑ    	   ܂ `(ؐ  @ ʈ   ܚ `0#@ @ 3        @ ʌ    ``         #@   @ ɮ         Ȁa    !'    '  h'D'H'L 7P @ l    @    #@ a@ h      '#@ a@ j      ؂  @ m    ``      @ ɀ     @ ' `0#@ @       ' `0#@ @       Ђ  @ &    ``      @      @ 'P(`0``(`0`@ q   D`     #@@ )      D@ @  ``      [   L`    L`  9    `  `#`    H`      @ Hø    `0  @     ` #` a a @  #@ L`     a @ ɲ   L`     @       @ $i    `   @f      #    a @ `         '    #@   @ Q      e   #@   @       8   'ȁ  㿀'D'H''耠` ]   H`     ' k   D@ ``  
   D@ ``        ' Z   D@ `H @ 'HH`     ' L    'D@ `䀣@    D@@ ` @R    `     ' 4    `'   D ` @G    (`+@@'D@ `D@ `'D `'   H`    '    D <c@    `     '    '  㿈'D'H'LD@ ``  A   D@ `L @    ?' 6   D `D@ `H  @   D@ `L @'LD@ `H @'HD@ `D@ `'DD@ ``     H   .+   `" L 'L   H(@    '  㿈'D'H'L'P'L`  	   LH@        ?' s   DL@@ ```  .   L `H@    ?' `   L `'DL@``DL@@ `(`   c@'LL`  	   LH@        ?' >   P`     PL'@ DL@@ ``  $   DL@@ `L@H@ 
   DL@@ ``     ?'    DL@@ `L@ `'L   쀠`     '    L `'  P'D'H'L'' a @ `     H@ ,8    D  *a?  @ (   H@ ,    `    H@ ,    `     !    c ``    H@ +     @ .    H@ +     @ .    $  =`   >l      H @ ,   '耠`        @@ `@ `(`@7 @@ ```        @@ ``     @@ ```     '     @@ ```    '̚ @@ ` @@ `(` 'Ț @@ ` @@ `(` '̀`  X   ̀`    '     '(`0`         '̀`    `      c ``    (`0`$  =`8 =    b b @  `#@ T   ̀`P   ` L    c ``    (`0`$  =`X =       b b @  `#@ 2   Ȁ` .   Ā` *    ''Ȁ@ !    e    '䀠        `耣@        `' `'   'Ā@     @    '䀠         `
耣@        @``@@ `(` '@``@``(` '@`	`@``(` ' `
'Ԁ` f   Ѐ` b   ܘ@܂#@  +   '`              '䀠    耣@    ܂@  "             (`0`        `  h    c ``    ' @    $  =`x  <       b b @  `#@  H   Ԁ` 5   Ѐ` 1   ܘ@܂#@     '`      ;    c ``    ' @I    $  =` <   (`0`           ؀`     @耣@    ؂ @'耣@         `'     㿐'D'H'L  P'D @     'D =`@    '䀠`     К       `         #@ a@       '#@ a@       Ă  @     ``  !    @      @ ' `   @w    `         #@   @          #@ a@ ĺ        @ {    ``  6    8@   '@        '@   '@   '@    $   `А   @(    a @     c ``     $  =`;      =`@    'g     p @ Y   #@ a@ Y      '#@ a@ [        @ ^    ``  @    @ q     @ ' b  @   @ "   $  ` 
#`  `$ b  ` 5#\@   ,bl    @     b  @ ` *a?  @ %    #`#@   @ +           p =` =a@    '쀠`      ` @ `  b    =a    \    ( @    `  O   '@ (`8``    @ (`8``
    @ (`8``#    @ (`8``      `'   (@ '@ (`8``     @ (`8``	         `'    =a @    `   А       @        h'DD =a@    '쀠`          ( @D    `  r   '@ (`8``    @ (`8``
    @ (`8``#    @ (`8``     Ԃ `'   (@ '@ (`8``     @ (`8``	        Ԃ `'   ؘ =a  @'    `   ؚА   @S    `     @X   '̂ @(    $  #` ``(` b@̐  @ n      @9        x'D @ r   D`(` b@#@ @ m      'D`(` b@#@ @ j        @ m    ``      @ Ā     @ ' `D@     @ '    #@   @ \         '؁  㿐 b4 @ `      
    b4 #@  =a        'D'H @    / cct``      =a@ /!     @   D'H(`D@쀣@ &    @ ' ````  
    c cx`          c cH`  	    b b @  `#@  `'    b0' $@   ' =b       '@   '@K    @ 'D'H(`D@쀣@ e    @ '    ``      b0ؕ b @ @ ?    O    ````  
    c cx`      3    c cH`  -   КВ      `      =b   И #\ ̔ !    @    `      b b @  `#@ В     `'؂ `'    b0 @ '` I      @   A    a@     `  #    c c|`  	    c c|           a@     `      ` @ `      =c        a @ @ N     b,0@ D'H(`D@쀣@ T    @  `````  
    c cx`      >    @      @ l    '܀`  	    @ '    )     @   ' @ #@  ` ` b,@  3@ 2 a @ #    b b @  `#@  a a @  `#@  `'    a @ `     a@     `          @ )f     b  @  @ `      =c    c@ 3    /ׂ``      c@ c     b  @   @ )%       a@ -    b(' a@     `     a@    ' '     '#@  b0' $@   ' =b\       '@   '@   #   a @ `  E       '    a @ `      7    c@     `ׂ`@ $   ׂ`/ׂ``      c@      b  @   @ (        c@      b  @    @ (    b  @ @ d       b0 @ '`     /   @   T    b  @ @ )    a@     `      c ``      a@     $  =cД 7    b0' $@}   ' >`       '@s   '@<   #  '؂#@ a@       '#@ a@         @ 
    ``      =a@ /!     @       ``  %   ؕ? a@     '?x`  	    >`0 @  `xH?xx	 b0 @ ?        @      @ 'И @   e    `      =b   И #\ ̔ !    @    `      b b @  `#@  b b @  `#@  @  l   @   #@   @ B      ؂ `'p    b0 @ 'tt`     tK   t@    a@         p'D'H b   @     b b b b b b b @ #@ " #  "  "@ " DH      @    b @ `      c ``      cct``  L    a@ #     b b  @ #@ (` @(` @(` b  `#@ #@     ' >a @  ` b @ #\ b @ #` b @ #d b @ #h b @ #l b @ #p$  >`8 ?   6i    i    b b  @ #@ (` @(` @(` b  `#@ #@[     ' >a @  ` b b b@  @ #@#\$  >`@ ?   62    2    c ``  ,    b b  @ #@ (` @(` @(` b  `#@ #@     ' >a @  `Ȑ$  >`@ ?  6     ` @   h'D'HH  ?c@     D`     @     a @        ' @ k   '@v    @ c   H  ?c@     D`     @ "    a @ ,       ' @    '@R    @    H  ?c@     D`     @     a @        ' @    '@.    @    H  ?c@ T   D` P    b''ܚ '؀     C    @    ܒ @ Ö       ' @ Â   '     @ {   ܚ`'؂ '   '`      ؂ @'Ѓ(` @'Ѐ@ 
   Ђ '@       '@   H  ?c@    D`      b' b̀@ 
   ̂ '@       H  ?c@ 
   D`      a@ _   H  ?c@ 
   D`      a@ Q   H  ?c@ 
   D`      a@ i        㿐   ?c        㿐    ?c        㿈'D'HD@ (`8``     D@ (`8`H@    D'    D `'D   '  p'D bL @ ' bP @ ' ` @ '耧@ ~   쀧@ y   '@'@  =    @''؀@ -   ؂@(`D@ @ '؂@(`D@'@ @؂ @(`D@ @ '  '@ @؂ @(`D@'@ ؂ `'   ܂ @'    @''Ԁ@ %   Ԃ@(`D@ @ 'Ԃ@(`D@Ԃ@(`D@ @ '  Ԃ@(`D@'@ Ԃ `'   ܂ @'    bL ` bP@  @ '@ bL @ @'   bP ` @ '@   㿐'D'H'L bL bP ` @ #@ #   b@ @  >a @O     bH @ L@ (`8``-     bD #@ L `'L     L@ (`8``+ 
    bD @ L `'L     bH @ `      bD @      bD #@ L   P'D'H'L'P'T'X b8 @  ` @ `      b< @ `      ` @ `      ` #@ DHL    'L b< #@  b@ @ `      b@ @ @ (`8`` A    bP `@  @ @     bP ` @ #@  bL `@  @ @     bL ` @ #@  bD @ ` Z    bL bP@  @ @     bP `@  @ @    H        bP `@  @ @     bL ` @ #@  ` @ D@ '    ` @ (`H@ @ @ (`8``-     ` @ (`H@  @ @@ (`8``      ` ` @  `#@     bP ` @ #@  ` @ D@ F    ` @ (`H@ > @ a0@]    `  7    ` ` @  `#@  bL bP@  @ @     bP `@  @ @    H+        bL bP@  @ @     bL ` @ #@  bPD#@  `D#@  ` @ D@     bL bP@  @ @     ` bL @ #@ ?'"    ` @ (`H@ @ @ (`8``-     ` @ (`H@  @ @@ (`8``      bD @ `     ?'    b8 `  (`H `"  @ "  '    b@' ` @ (`H@''P`      ` @ (`H@  @ @@ (`8``-     '@ @ `#@ P` #    ` @ (`H@  @ @@ (`8``- )   X`     ` @ (`H@  @ @@ (`8``      ` @ (`H@  @ @@ (`8`L E    `    '''܂?' b@ @ '@ (`8``     @ (`8``=     `'   P'' @ `  <    b@ b@ @ #@    @    `  #    b@ @ #@ @ @O      
   ''؂ '    䀠`     ''     ' `'Ԃ `'   ܀`  7   `  3    ` @ `     H ` @ (`H@ !b >a8  @ @K    b@ b@ @ @      b@ @ @$   ` ` @  `#@  ` @  ?'   䀠`     ' ` ` @  `#@ @ (`8``  [    ``  	    b8 `#@      ` @ `      ` @ (`H@  @@ (`8``-    H !b >aX@   @       H ` @ (`H@ @ (`8` !b >a    @    b@ b@ @ @      b@ @ @$   ` `#@  ?'    `` Q    ` @ D@     b8 `  (`H `"  @ "  ;    ` @ `     H ` @ (`H@ !b >a  @    b@ b@ @ @R      b@ @ @$   ` `#@ L@ (`8``:     :'     ?''2    b@ b@ @ @.      b@ @ @$  T`     T#@  ``  
    ` `#@ '    `'   X`      ` @ (`H@  @ @@ (`8``-     b@ @ @ (`8`L     `  M    ` @ `  4    ` @ (`H@  @ @@ (`8``-    H b@ !b >a@   @       H ` @ (`H@ @ @ (`8` b@ !b >b     @    b@ >b #@  ` ` @  `#@  ` @  ?'    b@@ @  `#@ /Ӄ(`8`L H    ' b@ @ @ (`8``  	    ` ` @  `#@ Ԁ`  
   Ӄ(`8``:     2    ` @ `  "    bH @ `     HӃ(`8` !b >b(@  @       HӃ(`8` !b >bH@  @    `Ӄ(`8`#@  ?'C   @ (`8``W    Ԃ@@ (`8``;   '''' b@ @ @ (`8``      b8 b@ @ #@  ` ` @  `#@  A    ` @ D@ -    ` @ `     HӃ(`8` !b >bh@  @:    `Ӄ(`8`#@ L@ (`8``:     :/     ?/Ӄ(`8`'    b8 `  (`H `"  @ "  b@ b8 @ '#@ @ (`8``     @ (`8``=    ؂ `'   P'' @ `  <    b@ b@ @ #@    @    `  #    b@ @ #@ @ @      
   '' '    `     ''     '܂ `'̂ `'   耠`  4   䀠`  0    ` @ `     H ` @ (`H@ !b >b  @ @    b@ b@ @ @[      b@ @ @$   ` ` @  `#@  ?'F   `     '@ (`8``  0    ``  	    b8؂ `#@  s    ` @ `     H !b >b@   @Y    b@ b@ @ @      b@ @ @$   ?'    `` L    ` @ D@     b8 `  (`H `"  @ "  6    ` @ `     H ` @ (`H@ !b >a  @    b@ b@ @ @      b@ @ @$  L@ (`8``:     :'     ?''     b@ b@ @ @      b@ @ @$  T`     T#@  ``  
    ` `#@ '     `'     b@ @  W'     Ԃ@@ (`8``:     Ԃ@@ (`8``: "    b@ @ @ (`8``      b8 b@ @ #@  ` ` @  `#@      b8 @  b@ @  X    b@ @ @ (`8``      b8 b@ @ #@  ` ` @  `#@  =    ` @ D@ )    ` @ `     HӃ(`8` !b >bh@  @g    `Ӄ(`8`#@ L@ (`8``:     :/     ?/     b8 `  (`H `"  @ "  b@ @ Ӄ(`8`'ȁ  㿐'D'H'LDHL             㿐'D'H'L'P'TDHLPT         㿐'D'H'L'P'TDHLPT        x'D'HH@ (`8``     D' z   D`     ' s   H@    '쀠a     ` @    '    'H''   @ (`8``"   "  @{    ,  (`8``        D '' `'@ (`8``  ,   @ (`8` @]    @ (`8`@    ܂ `'@ (`8``    쀠a    @   #@ `'    '   쀠a    @   '؁  㿈'D'H'LDHL@9   DL@(`8``     '    DL @(?'  㿈'D'H'H@    D@@ ` !`@``W`     ' 	    `'    '  㿈'D'H /L'H@    D@@ ` !`@``W`     D@L/@  `'     㿐 "` @    㿀'D'HD'D' bX(@ @ (`0``    H`    ' 1    `   bX .@r    ' $   @ (`0``     >b >c  >c@ x   H`    '     `   bX .@N    '  㿈'H'L'P'T'X'DH' !b@j    !bD@    !b >c8@    @+      㿈'DD`      >cH   D@t    '쀠`      >cx      㿈'D'HH`      >c   DH@    '쀠`      >c      㿈'DD`      >cH    D@s    '쀠`      >cx      p'D'H'H`  
   H  ?c@        ?'     b @ `  #   DH@J    `     '    DH@B    `     '     b @ DH    '     b @ `      >c ?`@
    '܀`  
    ?` ?`@~    '܀`  
    ?`  ?`@~    '܀`      b ( @   '쀠h      !b ?`0@~   @~   ' b( #@ ܀`  ;    b@ (`8``      b b@  `+@    @~Q   @@~O      @~M   '؀c    ؚ @ b@'@n    4  ؂ `'    b( #@     @~    b( @   @    `      b #@      b @ DH+    'Ё  㿈         㿈        㿈        㿈     (`0`   㿈     `   㿈     (`0`   p'D'H'L'P'T 7XP'P'H `<'@ (`0`'L`     '     'L@7    @ @      ?`h@~E   H #`HH #`H   $ 4 o   H `< @ @ z   @ (`0``    X3`    @ (`0``     ?`x ?` ] ?`@ v   X3`Ta      ?`x ?` e ?`@ v   H `< ` PT@}U   H `<T#aH `< @ PT@~    '쀠 
   H #`HH #`        'L`    `    `        H #`HH #`H#`4  x'D'H'L'P'T'X`7H'D'X' ``     ``     ?`x ?`  ?`@ vJ    !b  @|     PLT@     '`      ?`x ?`  ?a0@ v.    cЀ`     \:    (`0` ?a8  $  @ )   (`0` \    @     @    x'D'H'L'P'T'X`7X'H'D' !b  @|    b @ `     @ I    b #@  ``     ``     ?`x ?`  ?`@ u    PLT@     '܀`      ?`x ?`  ?a0@ u   d@     cЀ`     \    (`0` ?ap  $  @    (`0`ܔ \ ~   @ L    @    x'D'H'L'P'T'X\7H'D'T' ``     ``     ?`x ?`  ?`@ uf    !b  @|     ?LP@     '`      ?`x ?`  ?a0@ uJ    cЀ`     XV    (`0` ?a  $  @ E   (`0` X    @     @    h'D'H'L'P'T'XD' '! 'X`      ?`x ?`! ?a@ u    a`  |   T`      `'X' a'Ԁ@    'T@{   H`     H a#@ H @     'L`  
   L @@ (`0`#  P`  z    @ `  9    @   @}    ' 
   P  X@{   ' _   䀠`      ?`x ?`!( ?a@ t   ''X'Ȁ@    'P@{B    >   P  X@{   ' 6   P`     T`     H`     L`         'T`     T  X@{   P`     P  X@{y   H`     H?#@ L @ `     L?#@    `'D'H''H     ?b ?b( f ?b8@ t;   D c`     '   D c`     ?' "   D !bc @ #@ (` @(` @(`D !bc `#@ #@{     '̀`     '''H'Ā@    ''ؐ    @{   耠`      #@{p    ' #@{l     (` @(` @(`'܂'    耠`     '    耠     ?b ?b(  ?bP@ s   'D c'`  6    D@0`(``0@``  (    D@0`(``0@``     !D@0`(``0@``     DD c #c '   D c`     D c耠`  G    (` @(` @(` @{    ;   DD a`    @z   DD b`    @z   DD ba    @z   DD c `D aD bD b    @z   $#D c    J    ' !b  @y   D c    䀠`       D c    䀠` 	   D#ĉ?'    'Ё  P'D'H'L 'H `<''H `` 	    a`      '''L`    L`     
   HL#`H #`H    ؀`         L`     @   ?c  ` @{$    `         ''̀` 0   ̀`    ̀`     ̀`  ,   ̂` '       ̀`    ̀`    ̀` 	       H #` 0   H #`H#`4 (   H #`H#`4      ` a     $  ?bh @yI    @y    ?b ?b(! ?b@ rt   H `` ?   H `` :   @ L    ' @ @z   $! a`     @z       @z     ?b V    a@ @z    `    @z       @z     ?b ?   H #`0    H #`H     ?b ?b(!/ ?b@ r$    @      D@ @ 0` (` D@ (` @ ` (@8 @"	 D@ @ 0` (` D@ (` @ ` (@8 @"	!D@ @ 0` (`!D@ (` @ ` (@8 @"	!D@ @ 0` (`!D@ (` @ ` (@8 @"	"D@ @ 0` (`"D@ (` @ ` (@8 @"	"D@ @ 0` (`"D@ (` @ ` (@8 @"	D c@      DD c #cH ``    H `H`      a `      aa @y    'Ԁ`      ?b@x>    a  a@y    'Ԁ` 
   H #`HH #` z    a@y    'Ԁ 2   ܀` .   H#`0 D@ @ 0` (` D@ (` @ ` (@@"	D'D c'@ '@    '#c ?   Ԁ 2   ܀` .   H#`0 D@ @ 0` (` D@ (` @ ` (@@"	D'D c'@ '@    '#c    H #`HH #`H #`4  x'D'H'LH `<'L`    L`     
   H #`HHL#`    L`     H@H ``, ' H@H @ `,# '쀠`      ?b ?b(!t ?c @ p    a`      a@y    '    H `< @   @w    '쀣@ 
   H #`HH #` Z   䀠`  
   HH `,@# , N   䀠     ?b ?b(! ?c@ pi    a`  #    a@x    '`    `        H#`0 &   H #`HH #`H #`4    O    '`    `    `    H #`HH #`H#`4H `H`     H `< @      a`  4    D@H `< @ 0` (` D@ (`H `< @ ` (@8 @"	"D@H `< @ 0` (`"D@ (`H `< @ ` (@8 @"	 _    `` Z    D@ @ 0` (` D@ (` @ ` (@8 @"	!D@ @ 0` (`!D@ (` @ ` (@8 @"	 D@ @ 0` (` D@ (` @ ` (@8 @"	"D@ @ 0` (`"D@ (` @ ` (@8 @"	H `< ``    DH `<c @ @    DD c #c  㿐'D'H'LH '`HHL'`  ?cx'D'H?c @?cH `< @?c @?c ?c @?c H@ @  @H `$`    H?c`( @@    ?cH `( @?c @ a`     ?c @? @       @v    ?c @?c @ 	        ?c @?c @`  d   H `? @?c   @@ {        H #`HH #`H #`4??c؂ @ @ a    H@?c@  @@     H@?c@  @#@?cؚ@#@ G   ?c @`  "   ?c @  c@    ?c @ a`     H@?c@  @#@?cؚ@#@     ?c @` r   ?c @ 	   ?c @`d   ?c @    ?c @`    ?c @`    H #`HH #`H?c @# 4??c؂ @ @     ?c @? @!   @v    ?c @ @`  ;   H `? @?c   @@          H #`HH #`H #`4??c؂ @ @      H@ @  ?c@    H@?c@  @#@?cؚ@#@     ?c @ Q   ?c @?ca @@vi    ?c @?c @`    ?c @`     
   H?c @# 0 )   H #`HH #`H #`4D cЀ`    ?c @@vA    ?c @D ?c  a$@    ??c؂ @ @  >   ?c @`  *   H #`HH #`8 H@ @ `     H #` H@?c@  @#@?cؚ@#@     H #`?c؂ @ @      H@?c@  @#@?cؚ@#@ ?c؂ @ @   㿈'D'H'LL`     ?' k   L`     ' d   DD `@ # L `@ C   DD ` ?cP @  `H ?cX @  `HH#`DD `L@ `d# D `@tC    '쀠`     ?' 5   DD `@ @s   DDD ``# @"D ``     D `@tV   D#`DD `@   HL@s   DD @ L@#  DD `@  (@ '  `'D'H'LH `<'L`    H #`H H@ @ `     H #`    H #`    L` 
   HL#`H #`H    L` s   DHm    '`  r   H `$'؀`    ؀`
 !   ؀`     O   H #`H #`H Y    H@H @ `(  P   H #`H #`H H   ' H@ @  ' H@ `''@@ (`8``
     `'H `(@         '   H `(@    H #`HH #`     ?b ?b("Y ?b@ lh    ?b ?b("^ ?b@ l_   H `H`      @ `      a`  0    D@ @ 0` (` D@ (` @ ` (@8 @"	!D@ @ 0` (`!D@ (` @ ` (@8 @"	 _    `` Z    D@ @ 0` (` D@ (` @ ` (@8 @"	!D@ @ 0` (`!D@ (` @ ` (@8 @"	 D@ @ 0` (` D@ (` @ ` (@8 @"	"D@ @ 0` (`"D@ (` @ ` (@8 @"	 ``    D c@      DD c #c a`  a   H `H`  \   H `0` +    D@ @ 0` (` D@ (` @ ` (@@"	D'D c'@ '̀@    '#c .   H `0` )    D@ @ 0` (` D@ (` @ ` (@@"	D'D c'@ '@    '#c  8'D''''D c'D c$'D c<'D cT''??'D c'(`@ Ȁ`    (`@  `'쀠` 
    @ ' `H`    '``   `(` LbT@@    !D@ `< @ 0`(` `< @ `0@``  (   "D@ `< @ 0`(` `< @ `0@``     "D@ `< @ 0`(` `< @ `0@``         D     `H` b    `` ]    !b` @ #@ (` @(` @(` !b`  `#@ #@r-     ` B   D    ;   !D@ `< @ 0`(` `< @ `0@`'"D@ `< @ 0`(` `< @ `0@`' `0` `?' `0` `?' `< a`     ؀`     `     Ԁ`     ܀`      	   D P        `< a`     `     D ?    `H`      ``      !b` @ #@ (` @(` @(` !b`  `#@ #@q     `     D        !D@ `< @ 0`(` `< @ `0@`'"D@ `< @ 0`(` `< @ `0@`' `0` `?' `0` `?' `< a`     ؀`     `     Ԁ`     ܀`      	   D         `< a`     ܀`     D     `H`  V    ``  Q    !b` @ #@ (` @(` @(` !b`  `#@ #@q!     `  6   D     /    ``  *    !b` @ #@ (` @(` @(` !b`  `#@ #@p     `     D         ?c``n    `H`     D @ {    `'(`@ @     6    `' ``  .   D c`  
   D`##` ## !   D c`#  (` @(` @(`D c` #  #@p     `     D`##` ##'    `'      	*t 	*t 	, 	.0 	0Hh'D'HD''؂ ' !b  @o   H 	    #ĉ '     !bH #@pn       @' !bH #@pf     (` @(` @(`  @' А b@@pS     @' А b@@pL    'H' cЀ`    H`      ?cHc@     	    ?cc@     c`      ' I   H`  ,    !b @ #@ (` @(` @(` !b `#@ #@p
     '̀`     ''܀`  
   ؀`      '    #         '        !b  @o   ؂ `'   'Ё  㿐 !b @ `      !b  @n    !b   h'D'HH `H`     D !b@ ##`## 3   H ``  .   D c`  
   DH`##` ## !   DH c`#  (` @(` @(`DH c` #  #@o     `     DH`##` ##DD c `#cH'``    `(` Nb@@    H `H`  Z    D@H `< @ 0` (` D@ (`H `< @ ` (@@"	 D@H `< @ 0` (` D@ (`H `< @ ` (@@"	!D@H `< @ 0` (`!D@ (`H `< @ ` (@@"	D'H `<D c'@ '䀣@    ' cD c H@ E       H `H`  5    D@H `< @ 0` (` D@ (`H `< @ ` (@@"	D'H `<D c'@ '؀@    ' cH `< a`     H #`0D c$ H@     S   H `H`  5    D@H `< @ 0` (` D@ (`H `< @ ` (@@"	D'H `<D c'@ '̀@    ' cH `< a`     H #`0D c< H@        D cT H@         ?b ?b(# ?b@ f         	6 	6 	8t 	9t 	:t㿈'L'P'T'X'D'H !bD @ cԚ#  (` @(` @(` !bD `c؂#  #@nT     'L' !b@m   蕠 @` @  ` ?c?  @m    !bH@n    @` @m~        H'D'H'D cЀ`     a   H `<'H ``    H `4@n*    H !  @`  4@mS       /H'``@   `(` Pa@@    H `@ 
     H `@ 
,     ` a}    @     H#\#`D @`     i      H `` B    a`  '   H `@ 	    H `@ 	     ` aN    @     H#\#`D @`     :       H `@ 	    H `@ 	    HD @`H   $       H @ 3    'D cЀ` !   䀠`O      @` @l    ` @l    @(~ `  .       / a`  ;   H `@ 	e   'H `@ 	   ' ` a   '@ M   'H@     `      @`'     @`'H#\#`#d#hD @`@     d   H `@ 	,   'H `@ 	X   'H@     `      @`'     @`'H#\#`D @`@     ;   H `@ 	    H `@ 	/     ` a    @     H#\#`D @`     l       H `@     H `@ 	
    HD @a   V         	< 	< 	=D 	@ 	A8㿐'D'HD?H@         㿀'D'H'LD' c @ c   '耠`     !0   '  !0@l/   H 
   ?#@  #`    H@mu   $   @     @l.   ' 3    @ @ 
    #`L#a(D#` ` a  c@   `#@ "$ a$`  
    c@   `#@ "$ ` c @    $!'  h'D'HD'쀠`      @a0 @aP  @a`@ d    ``      @ahɳ    ``  j   H`     @a`ɤ   H`    H`     @a0 @aP  @b0@ d    ` c$' ` c<' ` c''Ԁ` >    ``  9   ԛ(`@  `'Ѐ`  )    @ ' `' `<쀣@    ԛ(`@H` `? И @     ``         '   Ԃ `'    ``      @b`;    a`  )    a@l         ` cЀ`     a?@l~     @l     ` @b a$     a@l~    a @ `  	    @ @k}   ?#@  ` a( ` c a@ t    ` c @         㿐'DD`      @a0 @aP  @c @ c   D a$   㿐'DD a@lC       㿐'DD a@l<       㿐'D'HH`     DH'a   㿐'D'HD`      @a0 @aP!  @c @ c   DH#a(  㿐'DD`      @a0 @aP! @c @ c   D a(   㿐'DD a`  @     㿈'DD a`     ?' %    D@@ (`0`'쀠`     D@`(`0`'    쀠`     D@`(`0`'    ?'  㿐'DD`      @a0 @aP!- @c @ c>   D @    x'D'H'L'P'T'XH'D' PLT@     '䀠`      @c0 @cP L @c`@ c    cЀ`  ,    a`      ` a         @ #\ @chXa$          @cX a$      `$X#`(    @    x'D'H'L'P'T'XH'D' PLT@     '䀠`      @c0 @cP j @c`@ b    cЀ`  ,    a`      ` a    '     @ #\ @cXa$          A`0X a$      #`$X#`(>    @    x'D'H'L'P'TH'D' PLT@ .    '䀠`      @c0 @cP  @c`@ bY    cЀ`  ,    a`      ` a]         @ #\ A`x!$  PI        A` a$P  =    #`$    @    x'D'H'L'P'T'XD'H' PLT@     '䀠`      Aa  Aa  M Aa0@ a    cЀ`  T    cЀ` !   \`O      Aa8 @h    ` X\@h   \ @(~ ` \ .       / a`      ` a    F    #\#` Aa@\a$           Aa\a$      \`     X@h    '\ ` X\@     P    @    㿈'D'H'LL`     ?' k   L`     ' d   DD `@ # L `@ C   DD ` Aa @  `H Aa @  `HH#`DD `L@ `d# D `@hO    '쀠`     ?' 5   DD `@ @g   DDD ``# @"D ``     D `@hb   D#`DD `@   HL@g   DD @ L@#  DD `@  (@ '   `'D'H'L'P'T'XD'H'?c @?c @?bܚ\ @ PLT@     '䀠`      Aa  Aa  { Aa0@ `   ?c @?bܐ   X @@h    ?c @?c @ a   ?c @  @ I   ?c?c @ ` 5    @?c?b܂ @  X @@hl    ?c @?c @    ?c?c @ @@        ?c @@g   ?c @    ?c?c @ @    ?c?c @ @?c?c @ @?c @`      #`H #` a#`4    ?c @`  
    #`H #`     `?c?c  @ @    cЀ`      cЀ` A    `` <   ?c @`O 5   ?b @  Aa8 @f   ?b @ `?c?c  @ @@f   ?b?c @ @ @(`?b @ `?c  @ .       ?b(@ a`  $    ` a    e    ?c#\?b @#` Aa@ @$         ?c?b @ Aa @$    ?c @?c @     ?c @@f   c    @     b @ `      w    b E   $  @h   @h   p  W   p  @g    b @ @h     @h    $   b @  @ `     @g       @g     Aaؒ l    b @  @     @g    b @  @   /  @g    b @  @  Ab@g    `     @g       @g     Ach B    b @  @  ,   @g    b @  @  *   @g    b @  @ .@g        㿐 b @ `     x    b @    㿈'DD' `   㿈'DD' `   㿈'DD' `8   㿈'DD' `<   㿈'DD' `4   㿈'DD' @    㿈'D'HD'H`     H @ @ '   @ `   p'D'H'LD'H@ y    '''쀠`      Ac Ac  Ac@ ^    cЀ`     @ ,     AcH    'Ѐ`    Ѐ`    Ѐ`          Ѐ`    Ѐ`         c'     c$'     c<'     cT'     Aco    `'`      `' @ ' @ H@        '   `     '    L@      'ԁ  㿈'D'H'L'P'TH `H`     ' D   H'`` $   `(` Wb@@    DH        DH        DH +       DH    H `H`      Ac Ac  B`@ ]   LP@ w   DHT@      '   	^ 	^ 	^8 	^T 	^p㿐'D'H'LD`      Ac Ac  Ac@ ]   H`      Ac Ac  B` @ ]   H `H`      Ac Ac  B`@ ]   DD c #cD c`      Ac Ac  B`(@ ]   H `<`     H `<H `< ` #`H `< ``      Ac Ac  B`H@ ]   L`     DH   HH `@DH`D@    DH@          㿀'D'HH'D c@   `#@ 'H`     Ac Ac  B`h@ ]Y    ' +@ '䀣@    D #c(`@   㿐'DD`   㿈'D'H'L'P'T'XL`     LL ` `#`L ``      Ac Ac! B`x@ ]   D cl @ X   '쀠`      T   '   T@d$   DH   $  H#` ` `0H`    H`         ` $ @    P D   P`      Ac Ac!/ B`@ \    !bP #@dW    @  @$  !bP #@dN     (` @(` @(`` @$   `  А b@@d8      @$` `  А b@@d/    $  L#`<T#`@X#`D !b@ # L`# P   㿐'D'HH `` 	   H ``        H ` @ q   D cl H@ 5        㿈'DD` "   D(` Yah@@     B`'     B`'     B`'     B`' 
    B`'     B`'   	d 	e  	e 	e( 	e<㿈'DD` ,   D(` YbT@@     B`' #    Ba '     Ba'     Ba'     Ba'     Ba(' 
    Ba0'     B`'   	e 	e 	e 	e 	f  	f 	f(㿈  @b   @ a    '쀠`     Ba8 BaX ] Bah@ [        㿈'DD' @    㿈'DD' c̰   㿈'D'HD'H'c  㿈'DD' c   㿈'D'H'LD'H#cL`      cԐ    @b       L@ ##`##؁  㿈'D#$   '  #@b    !b  @bS    c b @ `         b #@  `@   `#@ "  `    @b    `    @b    a    @b   ?#c c c @     c$ @     c< @     cT @     cl @     c cD#c c @     c @     #c   X'DD' c' c$' c<' cT''쀠`      Ba8 BaX  Bap@ [   '̛(`@ `  H   ̛(`@  @ `  :   ̛(`@ @ D   'Ȃ #`R    `@`D@     `<`      `< `< ` #` `< ``      Ba8 BaX  Bax@ Z   D      ̂ `'   #@ `'`      `' @ 'Ē    '    c @    'Ā`     @a      @a        㿀 ` @ `      ` @ ' 7     @ba    `  -   '  @bY    `      b @ `      Ba@a     @bC    `      `#@  ` @ '    '    '  㿈'DD @b    `'D @b       㿈'D'HD   @a]   H`     $ 'HDH#`DD `@a1    $ D ``     ?' 
   D `(@ DD `#`'  㿐'DD @ DD `'`D `(@      㿐'DD ``     D `@a7   DD @ #`DD `#`     㿈'D'H'LH`     ?' w   H`     ' p   LL `@ # H `@ C   LL ` Ba @  `H Ba @  `HH#`LL `H@ `d# L `@`    '쀠`     ?' A   LL `@ @`d   LLL ``# @"L ``     L `@`   L#`L @ `     L `H@LL `  @aA   L `DH@`9   LL @ H@#  LL `@  (@ '  㿈'DD`     ?' J   D @ DD `#`D  #`DD ` (` @(`    $ DD ` (` @(`    @`e   D ` #`'D ` 쀣@    D (` @(` @D (` @(`@ `#  `'   D~b `'  㿈'D'HD`      Ba Ba  Ba@ Y   D `~b΀@     Ba Ba  Bb @ Y   D @ `     D ``     D ``      Ba Ba  Bb @ X   D @ `     D ``  	   D ``          Ba Ba  BbP@ X   D@  1   'D `'耠`  
   #`#`     ` `H#@ ~b#`DD @  `#@ D#`D @ `    D#`   㿈'DD ``  A   DD ` @#`DD ` (` @(`    $ DD ` (` @(`    @_   D ` #`'D ` 耣@    D (` @(` @D (` @(`@ `#  `'   D `'DD ` `#`~b#`   㿈'D'HD`      Ba Ba! Ba@ X7   D `~b΀@     Ba Ba! Bb @ X'   D @ `     D ``     D ``      Ba Ba! Bb @ X   D @ `     D ``  	   D ``          Ba Ba! BbP@ W   DW   'D `'耠`  
   #`#`     ` `H#@ ~b#`DD @  `#@ D#`D @ `    D#`   㿈'DD`      Ba Ba! Ba@ W   D `~b΀@     Ba Ba! Bb @ W   D @ `     D ``     D ``      Ba Ba!  Bb @ W   D @ `     D ``  	   D ``          Ba Ba!! BbP@ Wr   D `'쀠`     ' '   DD ` `#`D ``     D ` `DD @  #@ D @ `    DD` `D `#`D#` @ '   'D'd'`D`      Ba Ba!7 Ba@ W/   D `~b΀@     Ba Ba!8 Bb @ W   D @ `     D ``     D ``      Ba Ba!9 Bb @ W   D @ `     D ``  	   D ``          Ba Ba!: BbP@ V   DD ` `#`D `'쀠`  (    ` `#` ``     d`     Ba Ba!D Bb@ V   d  (` #?x`"  `'   D `'쀠`  #    ``     d`     Ba Ba!K Bb@ V   d  (` #?x`"  `'   '``d@    `(`@ x@]   ` `'`        㿐'D'HH`      Ba Ba!U Bb@ Vm   H `~b΀@     Ba Ba!V Bb@ V]   D`      Ba Ba!W Ba@ VP   D `~b΀@     Ba Ba!X Bb @ V@   D @ `     D ``     D ``      Ba Ba!Y Bb @ V(   D @ `     D ``  	   D ``          Ba Ba!Z BbP@ V   H ``  	   H `H `#`    D `H@     Ba Ba!_ Bb@ U   DH` `H ``  	   H `H `#`    D `H@     Ba Ba!f Bb@ U   DH` `HH ` `#`HD `#`DH#`DD @  #@      㿈'D'HD`      Ba Ba!x Ba@ U   D `~b΀@     Ba Ba!y Bb @ U   D @ `     D ``     D ``      Ba Ba!z Bb @ U   D @ `     D ``  	   D ``          Ba Ba!{ BbP@ Ui   D `'쀠`      @ H@ 
   D    ' 	    `'   ?'   < "@  @  "``D @"`"@ P p   r'  d h'Ȃ @''!  `  U   @]   Q "̀  "  h @@ @ 3   `  ; `` 1   <& @     ` & < @ @ 3   `      ?' ''ƀ     @`  %@@* & p ! & l& pؔ @[   2%@&  ?```   @ `! @]e  ? l 㿐   @]] ?  "@  `!   B @[~`? 㿐@         @\)       ?߂b!@[      @[!N  ?`/$$ ? B# B@px d@[S !?߂# @# @    #0 @ d@]  ,@ @[u   $  $@ 1    ?  @@ 4   &   `"   4ex   @        @       Y 23     @    ?  B@
c@      @     ?  @@    &    * bc@       $$@[    $"  $ᬂ "      `@          Bc@[̔   ?ߨcccc'@ `  ?߂c`   "  #@[n !? Р#(b@%@." *  @[f*  @  $   b@     f " ?߂c !  @'   @ b   R    @[c   A "$d@Z    $h  `$ `ac|$| b$$ g g`a $$ ` `alc$$ $ $ "@ i `!  @\1    & @[     & @[   ᰀ      @Z  ݰ  @Z@ M ` B  @ZB!   "@ B ` B @ < ` B     @ ;b  t  "@ - ` B ` `a?`]? B@Z#  W?ߔ  ! B"@ZkcN' "@  ` C 0 "@  ` C H  $$ 
  C X {$$ "  ! C"В`p@ZB   @ Ô    C  `@ Ȗ   w  @     
   C @ `  6  ! C"В`@Z       ay@ Ɩ      "@  ` C l?߂c@      I  # "` "  @        C! @Y8 @Yɒ    $ T'` "  C@       @ ?ߒ # d@[L@)!? "@ { `!  @[C      	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	㿈@Y}    Ђ``	 >@
 # "N?`/ `9    @* 	# "N?`/ `9$ # " $`@Yx 
H@ `  ``"   &  C&@     !  @Y#       C  ! @ C  ! ` C  ! x ?߂c  @        C?a @
@         ?  㽀  C !@Y$     .  "@ av       #  % C  @Xِ        @ f?     
     " `@ ʰ?!   C @X  㿀 '''    @Z      " `@ ?  !   C@X  x`   '@   ''''  @Zd܀   >@  " "`   
 䀣  <  C   ! @X 3?@      C   !  @Xt?0 '耣   ` @  !    C   0!     `'@ @ b` C   H "@ Y ` C   ! ٔh  㿐  \ .  db @      C Yb C Vb C Sb C Pb C Mc C Jc8 C Gch C Dc C Ac C >c D ;` D 8`@ D 5`p D 2` D /` D ,` D )a D &a8 D #ah D  a D a D a D a D b D b@ D bp D b D b!  D"b@X"   	 	 	 	 	 	 	 	 	 	 	( 	4 	@ 	L 	X 	d 	p 	| 	 	 	 	 	 	 	 	 	 	㿐  G .  e`@      D Vb D Sc D Pc D Mc( D Jc8 D GcH D DcX D Ach D >cx D ;c D 8c D 5c D 2c D /c D ,c D )c D &c E #` E  ` E `( E `@!  E"`X@X"0  E `p E ` E 
` E ` E ` E`ȁ   	 	 	 	 	 	 	  	 	 	$ 	0 	< 	H 	T 	` 	l 	x 	 	 	 	 	 	 	 	 	 	 	  	㿈  ' '  Cᐁ x     ??  'ܘ ''7ؔ  Eo  
  E 	 cc$    㿈  ' '  EY  
  	   cc$     㿈  '  EE  	 
 L E   cc$   㿀? '?'  @Wc       㿈&  &@ & !   #@X   E   .a # !`@# 
 	 '쀋  ! @W
   $@ @  
`(` 8` `. '@V    &@ 
    +`';``.  
@V   &   㿐 |   @   㿐 |   @   㿐  ` "  |   @ -     ` $  &@` 4        @    " |0 @   " #  `# `# `# 㿈 '  e  ܀  4   @    #@ `" #``#``#`㿈  '쀠`  !&@  '  f@ -R@   ? 	  | f  @ @  "  㿐!      @V\    &@    "   "@ $ `!  E h@V?0 @VH*   &@ !!@U*!  㿐! "         @ 8  @  r    	 E E @U! ,?  x + !@    + 0〢 
    ? ?&    !`@ ` `? `?@2&   
@ 
   Gbh


@ `



  @ `     
@ 
  


@`
 㿐 `` " ?`    Ր    	   ` 2  ? `   `` "   `    `@" 	   `      `     `     @"     ` 2        $ 0 4      	  G !ch c "    㿐  @   㿐   @V/  ? 
   @   "@  ; `!   G p@U/?  㿐   @   㿐     @V ? `   
?   @V  ?  "@   ` G !  @U	?0 
 "@  
 ` G !  p   `      㿐  @   㿐  `   @  !  G@T? 㿐  @   㿐 !  G?@TԔȁ  㿐 h        `     @U~  @U.          㿐 !@T       @U! g gbHb$ $  $ $   㿐   @  8  @?  㿐   @   㿐 @  !    @  @T  @T    H 㿐  @T       @Tf   㿐 H `@Ui    )c@T   
      !``@      
 
   @`"  `@     	 @T       ! 㿐  D    Ҙ   " U&     @        @T<    W      2 @T]    D "$  @TH @TU  @T=$   " 	$ @T> @TK  @T3$ $  $  $       " @   `     `    ``   `6  `   ``     $  '  &     &@  `?!   H @Sܔ0 2&  0  㿈p   `h   ?? Y쀠`  V  @S    G  C&  7    *&`  8\/    "&`  .d'    &`  $l    & ` " # @ `  `  " # #@  !   " `!   H @S@S  ?&&&& "| `!   H @Sq?  㿈     " 㿐   7             +   `  #    `      `     @S `  @S        @S  2 0 @S@S@S    @S    @S      㿈  @ :)  ?  H ``  ! ``  @T   0 `#0 !   p   	 H `@S     & &@  q   @Tu     b    ????  @S  #0 @Sa   <a&@  @Sڐ    & "@S 䀠`  & @   	? &  @   @ @&@ 0     
@?8  
@?  H ! @R    -? ` H   ! @R   @Sb  ? " ` ~"      H   !   H! @R0 " ` H !  Ӕ(  㿐  c'H'L'P'T   'X  @TY#d/    H@So!  㿐 ` *c @ "` $  (@  @R     $     @R   @ $   Hɐ!    @$   㿐   `c    " @R   $    㿐@RZ      @S   㿐 Ђ " " " ` 㿈 "   ` #`t  'D'H'L'P'T c#c @S#d   STD 7  `    C&$L   = H@ 2   @ D@ 3@      `t H`  +!9 #`  (#P`   " ` `       c@ $HH `  @ 2#@ @ " #` " 
 H`` ``  H!D   $'#ŐaD H `! @Q  ?@ 2?q     㿐          ?      㿐    &  @R   &          ,` 2  T <" <` 2 ,0 " T     #D D@ `,`  `<`T  `  #@ 㿐 L `$ ڐ  ,   `?C& , ѐ  `  c@      㿐``ǐ  ,  `?& ,`,  `?&`, ``,&`` `?&`,  㿐 ,``  `?& , ,  `? & , `&``   , `?" ,㿈   #\? @     㿈   #\?  @  |   㿈   #\? 0@  q   㿈   #\? 0@  f  㿈   #\?  @  [  㿈   #\  @  P   㿐      ```+`+ *  
       s  `` @@ *        [  ``     }      H    㿐  @   
 +  T "  " @  # \    "  0" " `  & ` `? `?@    I     㿐L    c\ ?+ - ) % ' 1 # !      cH#cL   %``%0%#X$8$<& @$`T$ D"`H"L#P", cP #`(*  lc@          `4#`X   `\    `4   `X   `\    ?    `4    ޘ    `4   `X   `\ Ҙ  , ?  `4#`X   `\   `4 #`X    0  ",   `4      `4   $8%#X  ?$< $`T `4%0  & @ `XĘ      `4    ?    `4 ?    `4#`X ?}     `4#`X  s   "L"`H? $ D#P  `4 @ X",  ` `4 l [    `4#`X?U   ɘ ?    `4 V  `` H"(      	` 	 	d 	d 	d 	d 	 	p 	 	  	 	 	@ 	d 	d 	 	 	d 	d 	 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	  	, 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	8 	d 	d 	d 	d 	  	 	d 	@ 	` 	x 	d 	d 	d 	 	@ 	d 	d 	 	d 	 	d 	d 	 	 	d 	d 	d 	 	d 	4 	\ 	\ 	@ 	H 	\ 	d 	 	 	 	d 	 	d 	d 	8 	8 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	d 	 	 	d 	  	@ 	( 	d 	d 	d 	d 	d 	d 	d 	d 	8 	@ 	\ 	\ 	\㿐@       ` ] `@ "  " @  0 T "   "  㿐  -.  mc|@           $   `,    `X  `\@      0   `X @@"  " @  0 	  `X  ސ (@O8      	 	 	  	 	 	T㿐@        1      `X  P  #@ @ #`  T    #  @ #   d    #  @ #      @ #@    "  @  0 	ސ   `X  "  "   㿐Ӑ   `?"  " ̐ Ђ " " " ` 㿐  N!  Y     I   4%   `4   !  4 %   4 `     0 a ` ڐ  4 `   ? Җ   #   a7 @ ;    4%ܔ ͐     4a7   0 7 4 %   4. `Ĕ `  ! 4 ` % 4 %!  4 %       `  `@    W  4ʖ      㿐  I!  S     D   4%   `4  j !  4  d  4  ` ]   * 0 _  `S  4#   a7 @     0  4  C   4  < "  4a7 5  0 9 4  -  4.  `ɔ `  ! 4 ` % 4 %!  4      `    4`  @ y     Ԑ  4ʖ  4     㿐% (  0  <      " "    d   @ i$    $    @ ` @     @ Y$  $   L  #@ @ P  (    @ @ G `~  "  @ A  @ > &     ```     oa         㿐1  (    @    & (^  ( a" "     ```    obH      㿐  cP`    W"   (  !   H"H&    @     !b݀  H ``8  (` pc@     a  ( "    K  & "  %    "  +   B"  1  `4      G  " # ` " '     (  !  4  !4  4   -.     4  /%   	  ِ ` "̰ )   .   `4`  	( 2     #̔ #    #   #     ڒ  ג   (   ` `m`? `?           c ` `   `$` 21    S     `i ( 2i     {   c\`       ?        g    @ k 5 @ -  ( ,!     ( 2>  !  4    4      t  D `5  ` 2%    `4  6   `4  0  4  r  4  ݖ  H"h H"@    & " %
   ` " '<   ( " !  H֐"7Qа      ? @L#     	4 	P 	 	 	 	 	L 	X 	X 	T 	L 	L 	X 	 	 	X 	p 	 	 	L 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	T 	T 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	L 	 	 	4 	4 	 	 	 	 	 	 	 	 	 	L 	 	 	L 	 	 	 	 	L 	 	X 	ä 	ä 	ä 	ä 	ä 	ä 	ä 	ä 	 	 	 	 	 	4 	@ 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	L 	ä 	 	T 	ä 	ä 	 	 	 	 	 	 	 	 	Ø 	ä 	ä 	ä 	ä㿈6 ?//6  // //6`//              `4% 	  `4    k`    `4 `       `4*    ` 䀢%  `4    qb    㿐 ;. r`@            n     0 (            ۔    0      ϐ       ǔ ٰ @J      	  	 	 	  	p㿐` *.` ra@       `0 ` 6   `0        ͒ 0  ߐ   ې    0 @J      	( 	 	 	( 	X㿐` '.` rb`@                   0     ސ   x 0 @J      	 	 	 	 	 㿐` '.` rc(@        ѕ          i 0     ސ   F 0 @JM      	ʸ 	ʘ 	ʬ 	ʸ 	㿐` .` scp@       ѐ   Ж  E  "  " `" "           Р " " $ `8"    z           Т  "  ``" "      ܐ Р " " $ `"    
R   ݒ      y Đ Т  "  ``" " ̒    k   Р " " " $ `    
*       ɒ    Q   К  "  ``"  "    o   =   Ж  E  "  " `" "        &  p Р " " $ `"       q        W Т  "  ``" " _      H Р " " " |$ `           Y          5   @I;     	 	d 	ʹ 	 	,㿐` '.` t`8@       
           % 0     ސ    0 @I	      	 	Ϩ 	ϼ 	 	㿐` w.` tb@@          ' &  I .  4   `
   ג     7    `   ǒ  ے ' " $         Ȓ         Ԑ        0           0        HY# @H      	 	 	p 	 	  	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	$㿐?              `      K 0     @  @HJ     㿐( ~. uaD@           cP`  q       9       0 0 ]  (     (   7   5 H#(    H#H H#h H# H# H# H#  I  I 8 I ` I  Iݐ  Iڐ  Iא  IԐ! Iѐ!0 Hΐ#  Iː!X IȐ!x IŐ! I! I! I"  I"(@G     	X 	4 	 	 	 	 	 	$ 	0 	< 	H 	T 	` 	h 	t 	Ԁ 	Ԍ 	4 	4 	Ԙ 	Ԥ 	԰ 	Լ 	 	 	 	 	 	 	 	 	4 	4 	4 	4 	4 	4 	4 	4 	4 	(㿐 I "P       ` ` I"pX   ` \
 U Ni ࣘ`? `?  A ?w ={ & ``z   I 9  @ ? @ `  @ `  <  @   ?`  b @ `  0 ,Ɛ" c\` "`    ? i b  b   1 @   ̶   Ƕ   ¶  J  C     㿐 ( ̃.  vc$@       @ L   ð  I"   (      (    5     	                  ݐ ѐ 3ϐ 2͐ gː p   Ґ А  Ē   ǐ BŐ Ð    @      @    ˒    @  Œ    @      @   0 ^   @      @ ݐ       @ Ր     @ ϒ        @ Ɛ     @       ѐ    @      @       ې    @      @       @         @       IE#@FN      	 	 	( 	< 	D 	  	P 	X 	` 	h 	p 	x 	؄ 	ؐ 	؜ 	ب 	ش 	 	 	 	 	 	 	 	 	 	  	 	 	 	  	( 	٨ 	 	 	 	X 	ژ 	 	 	㿐     Ђ E " "   & `c2"    	   k`    㿐   	(      *. wa(@            !    ې    א       ΐ    ʐ   ʒ   @E    Ò    	ܤ 	܀ 	ܘ 	ܤ 	؝㿐](  ` $   `      @E                   ` `           㿐   @           Ӑ   t   㿐   	 S   f  0. wct@             &      Ȑ     Ð   ]             7   @E=    0    	 	޴ 	 	 	㿐ʐ(   '          @E!             "                     㿐` <?.` xad@     @  ? 1  I#0   @  ? (   @ ( ? #  I#H ? I ch@E#      I cp@E      I cx@E      I Ր#  	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 @ $      !@DD``   ``    I#_            0 2 I  `` I`# "  [ ` `'`"   ( )  P  X 0 `	"  " 'dH  X " "  'hA 'l" l " "   `8 'p" p ; `pl#  `"  , p't  `" "  $ 'x" x"   `x 3 $ '|$  "    X'"  P"    "  '"  '$ "   " "  '  '"    X'" "   " "  '  $" "  ' "  '  `" "  'ݐ  "  ?'" ֐ p' `x"   `l"  `  >p>t#`   `d "  " $ `$ @ n  Ð 0  I:# 㿐 J    `( }.` ycT@     R(      	      0 kD   J @v    J p J  J  J  J  J!  J! J!0 J!X J! Jߐ! Jܐ! Jِ" J֐"@ JӐ"X JА"p  ```h `k" 
#             ?"               J" J" J" J"@CB      	l 	 	l 	 	 	 	 	 	 	 	 	 	 	( 	4 	@ 	L 	D 	D 	X 	X 	d 	p 	D 	| 	D 	 	D 	 	  	, 	D 	D 	D 	D 	D 	D 	D 	D 	D 	8㿀@ ```` ``       A  6   @      J@      J "   `48  `? `?@     `?  @ `   z  @   ?`   @ `  j @   *   2  |  ```w "    D`{` 5    `
`  J#   @    " 	 Jђ  @Bl C  #h `i J@ z   "  JW   #@ n   "  J   #@ b   "  J ְ  # `{ ``z J@ O   "  J> ð  u#ɀ`0  c\` " J    ?  { @ 3   " Jw   F 0 @   @  @    @    J@   # @ 耢   0  '耤  耤  h 0 Ā` 
`  ' K *  K & 0``  K' K  H`쀠` ' K  `@ Đ    ?   	?*    *` "*  -  K  x f` V` `"  H@A   /!  @   @  @    @    K@     @ 耢   1  (耤  耤   0 V` 
`  ' K   K  ؀``  K' K  `쀠` ' K !     ' ʔ 0 ' K !8    '  0 @ X     K@ &   ~ J@ ` {    Ԑ   r!P 㿈@     $ ` (@  '@    $ (@ 	 
' `   K!h    K  !    K$ ?! (@ 	' K ! 㿐'H       ~ @ ~H " v K H          2  J?H G 0 g#      (  #   ?H   @+@*@'H  <HH   ?   (`*`    "(`'H KԐ"H     '   "  H@@   Ð!        2 	 K?H   0    H  0 H 
 0 !@ 0H  㿐@ `  ``   K"0e    `` +
 & !i ࣘ`? `?   w { 
 z2  K`G  "` c\` z  `* `  `  `     ?  ~ `~   M    `       `` 2 " 㿐-  a"   "  㿐$  `"   "  㿐@     @ `"      K"    ( .  }b@      K"      %   Ր        #@    "      `, @" "   `  &`  }      0      ɐ     #@    "   캐   `X " @"  y `v   @        U&@   Q&@ r  @ t  ] 씐     U#@ 쌐     M#@ 섐  "   F  ` `X @$ u n   큒 @   ``ࣀ @   @    w2  K2 @ \  {"  K# H KI  &`P  `  `  @     	 	 	 	 	 	t 	t 	t 	t 	t 	t 	 	 	 	 	 	 	 	 	 	 	t 	t 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	0㿐     1   " " `   $    ϒ ̒ ```@  & @  @   "   `       0    ! ݐ    "  ސ Ђ  "  " ` ʀ   㿐@  n    ͐  ʐ   "  Ő  " "  $ & &   㿐뺐 @  V  뵐  " "  밐  " "  $ $`$` 㿐  i 렐     #@ `#`뗐   "    W"`  㿐]  c  념   "  G  D A `= @  ,`@  *p   @  
"  `$ &` -   㿐  `d . @`   ;`0`@#@" K8#0 "@  *  `d @㿐B    "  < " " " " `   ~bؐ 0   㿐   e   㿐 =    > &  <  @>6   z    T  |     	 D  T  F "   "  Ђ  " " 6& `  㿐     %       K#h   (   `  8       W       P       R  `` `? `?  D >
 8 2i ࣘ`? `?  & $w "z {   c\`    K#   ?  ݲ   ܐ#X  뫒   1  }#X1  g#X1  1#X1  #X1  #X1  @ #` 㿐  -  w Ђ E" " " ` "  㿐            KM#(     밐   g    `` `? `?   /  
 , " ) i ࣘ`? `?  "  w z { K  c\` ʔ    ? g `   `0  /  i      ɐ   Ф E  " " " " `         Р " " " 3$ `z         ퟐ   Т  "  ``" "     퐐  ڐ Р " " " $ `U   ޒ      z  Đ К  "  "  ``"  1  @  #` 㿐 ```" 1   A``u" 8 4 & ~` `q"  `` L鈐             Ӟ  Ր    p  ΐ     i 0 +```         0     @   ,ٔ 4  N`뀦  ```     Δ     ǖ ـ` 㿐  `` L `u  P @;     @;ܐ ŕ  L  x)      㿐  `` L `u   @;ɶ     @;Ð ꬕ  L        㿐  ```u   L!  $W   㿐  ```u   ( K   L!0   㿐  ```u   L!X  :  㿐  ```u   Lڐ!  +  㿐@ `  L``   LȐ! ``` ``? `? L`@       㿐` '.` a`@         C          ے 0     ސ   鸒 0 @;      
 
 
 
 
 㿐  cP   - ' )    `  $ 4  X ``%    ` cH` $L\$4 `% X%\/  `   L    逰 0  LV! L R!  㿐# % `XP'  `  -$L ```	" #  `h` `` L9"   `4  "  G       L  0 ,  鳖    H    `4  "    顐 値   `X\P `` "\$`X$P    " ob c   㿐  "Ȑ d  `X`4   cH#`X   `\#cL   	"`4 `` 㿈?̀` F(` a$@       cX L`  9"H  `8 6   #\     1?  cX L`  '"h  `< $ #\     `@  #\       `T `#\  cX`    `@ L"   @:        
 
X 
 
 
㿐?ꀠ`	 (` c@       cX L`  "      3     4      蝒 0   cX L`  ~"ؒ      3     4   cX L`  m"     q 3     4ْ   cX L`  \#      ` 3     4Ȓ   cX L`  K#H     O 3     4   cX L`  :#h     > 3     4   cX L`  )#    5-   `T   c\    `0   `4     `X #`\  cX`  
 5        c\ L#   @:       
	` 
	 

  

D 

 

 
 
 
 
㿈   J       @:    `D L ##؀`   #\  R? L #       `P `  .`  #\ >  M    M H     `L M h  @ .`   @?(`   "#\ M ѐ   `H M   @ @`2
*c  (`   @ 0?#\  M  \    㿐?׀` (` bD@      6   6   6   6 
  6  M 6  Z@9    m    
 
 
 
 
 
㿐  X   F   cX@9s    M`  *   c  & G  cX` "  M )  *  g  +c  -_  .[     ? 0 ?!     cX M` !@ )  *  C  +?  ,;  -7  .3 ِ  cX M` ڐ!h     4      4         30  㿐   `@    <&  `  
& d " `* & $& d #     T < T `$`$&    㿐  " ``*@8   ` `#`Ё     㿐 #  `` @8 `?, `?$  ? `?,  $ h* ?#@ $   : " `*  ` " ? @ `h0``<+ ` , @ 
#`d` 2@ ?* 0 `h 
    @#   `T` `h    @#   `d  㿐   6 / @   (@@ &@  8 
    @'    P 
    @'     㿐 %  ` @8W `Ƞ? ?, ?$@ 8*@7   P*@7   $   # "`, @  " ? 0 H d     ?`  㿐 !  `@8)    `ĕ*@7   $  : " `+@` "  @ `l0``<+  ` . @ 
" `d` 2@ +0  l 
    @#   `T  `l    @#   `d  㿐    /?
` )(` a@     
` " ` `   `
`@  `` ?     
 @? 
 
 `  c` @7      
P 
P 
t 
| 
 
 
, 
    ?
` (` bT@        
   ?
  c`     
 
$ 
, 
, 
 
4 
4 
<㿐                     2   ``2 9& |    3  
  - (@@" + *& |  @"   @u    	    ,@"    ӑ,"  ΢@  @"   @@"0@7-   & |& t& x  㿐 $    # "`, @  " 
? &  d     ?`   # "`, @  "   < T `| |  | x@
*&  & | d  2 <  ,   㿐 "   ``$ ! b "  * ` #`  @61    @6#T   㿐..`  @6@ *   @       @" %    2    `   ` #`  ` 
 " ! b* #@@#` "  # & "&  & & &  
 
@2  @2    㿐 !   b.`. @ @@ 1` @  ` " /" 	      * 	@6     0   ` "  M@6    & @6    &   `  p P
 	 &      &  : 	 * 	  	-!& &    `   < T" T" <㿐 ` 1 ! ?`    @ " "   `  "    
  "    p     ` c      @"   ق ` C   ӂ   `ς   ̀`   * ł  `  `      `瀠`@2 " "   @" #$    "耣    "Ѐ  `  @ " `  `  @ "`  "  #   $   `a  @ $  #     @ !E" 3  (` `    
`  " ``  `0`"  @5     `? T <   `  " s& < q& T"  `@     쀣  @@  `   T& <2  <& T   @@E@ ` !` `T ! ` E` E& & ? "@ #`   !` ?"@  @&   ` (` ` "     `?"@  @&   `` E?"@  &      "y   "    を  "݂   㿐   3*  `@        3      `@`@@
 ? #@ &             `D`D `@ (` @@@?#   `D `D`@`D  	`D ! b* ` 2    
   &  `  @&    `  (`@ ! b* `   &   `&   (`@ ! b*@`   @&    &  `  @
  `   	 ``? `?@?p @`? `? ?  P`? `? 2 &   !`@b(` ` 2  
    `@       &`@    `@ ͐             X
  !`D b* `  `@*` ` &  `D  (`  ` &  `*` ` ς  `` ˀ @`? `?@   &  `D`@@,? H&`@ 0`? `?  P ``? `? 2 
&  p ? 1&  &  &     4    `@`@@? "#@ `@`D   `@ ! b*` `   &  `@  (`  `  	}&  `@`D`@    
 L 
 X 
  
  
! 
$ 
$ 
  
$ 
$ 
$ 
$ 
" 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
! 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
" 
$ 
$ 
$ 
  
$ 
$ 
$ 
! 
$ 
$ 
$ 
  
$ 
$ 
$ 
" 
$ 
$ 
$ 
  
$ 
$ 
$ 
! 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
" 
$ 
$ 
$ 
  
$ 
$ 
$ 
! 
$ 
$ 
$ 
  
$ 
$ 
$ 
" 
$ 
$ 
$ 
  
$ 
$ 
$ 
! 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
" 
$ 
$ 
$ 
!8 
!| 
$ 
$ 
! 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
" 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
! 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
" 
$ 
$ 
$ 
$H 
$ 
$ 
$ 
$P 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$ 
$㿐X      * &@    * @  " &@  `?#   &@&`D&`@  H       ????????? 	 Ғ       !     ?    	 * 
@2 #    $ $   㿐 p   _  ` @2 H   "     *@
@ ``@ #`*   2   Ȁ   
 ̐       `       `? @  @"   Ȃ@ `? @  @"   ̀@"   ``"  G   `"    &       & ` "  &  `   @2& H   & 4& L  㿐`         / .@@ @`@    /     㿐`    @   ` ` `  @ 	 `?     
T " T <      㿐  `<`  B    `T@ 3-    9    ,@`  ,+ " @3W `? -  * @,@    `      	` & 0 &  < `  `0       `<#`&   㿐 p    ]       `  `Ȁ S      2 ``<@ `<`T      C   < <@ >     h7`(` `* 4   Ȁ@2 TT       (   <@ $   h @@    Ȁ@" TT '     &T`    `<@" '`<'`T   2    `&    㿐 p    ]       `  `Ȁ S      2 ``<@ `<`T      C   T T@ >     h7`(` `* 4   Ȁ@2 <<       (   T@ $   h @@    Ȁ@" << '     &<`    `<@" '`<'`T   2    `&    㿐6    $@  I   ` ' ",`@  " 
 4  d   `  0 @    ' ",`@  " `ː 0ɐ H d     `@@    @ ' ",`@  " ` \  d     `@    `  @ 
 ! ` *``@#`p $`   " `*`  " <T p0 `# ppHd ` "p` *`   㿐  `` "` " O   `` " "<T@2< &  ``  < T@2<  㿐!   $  Z S &  N  `    㿐  @ M      @  X  @  ԁ     㿐!   @     `` &  < T   ` `#` b         `   " ' `    @ " `   `  $    @ @    `@    ` 	 `?` 뀢  @ "`倢    ۀ`   " Հ`  㿐)    @  - ! ,``@#`d  ,   - !+ ,` @``@ %    @ U- ! ,``<`  `@&,` I  `d` " `T#`<  `T `d` @#`T  ` 6ܢ,  `@ 	     &͢  @"      @ @`d` "  # d@   <<@   TT@2逢   R䀢   )   㿐 "@/I ` !@/F b "@/C ` !@/@ b "@/= ` ! `@/9        
     8  @   2   㿐      `@"    <&   T       㿐       `@  ! `& +`" < `"&   T  㿐      `@"    <&   T               㿐!    `$ + ! @.*    %`   `) $ %  ! (` @/ "@.$    % @.*  "   { `  2  `-  41 `& @.%  @.  , @.p  !   c b      ` `(`,  #`h        ` `(`,  #`l        ` `(`, @ `0"@ `8 `0 
 `X `P* `H `@  `H "@ 
  @   @ @!  (`@.'$ $ $# !$b(` @. * b "`  #`    M0 `, @   @ @ MM"     㿐        `@ հ  T$          <          `,    `(   @
  (`# ?# "`,:  $ (  @   @    @  . $  @   @  @.  `     " $` 
`` D4@ `  2  "  
@-  
  <4@    .$` ( ( @#@  (   `   $  n  ,`$`  4` T ( `(@# ? ( ,`  ` 2 ,` $   `*`& 	@4@ ` P ,``  M   7b`  3- M  8        
*`@ "`@ @  `? `?@"` M  bXڈ       ,` @    ,` M  bp@.f   2T  Mm"  㿐#   +  )    `V$* &@ @-        @-.   `  `$` %`(% ,   	   @-9  MC"  㿐# @ (`& @,    & ` @,  0  "׻ `!  M @,?  㿐 @-           `   `@ ` `  㿐 @.|    2    㿐  M?c@.s?  2  
  M@.lc  2  
    &@ `  & @ ? 
 & `    &@    㿈  Mc @-耢  & @,     (   @,n -    .   Ô           " 
  @ ?&    @,  0 &@ & ?&   㿐 @.?  2    㿐  c`    c`  @,(   "     `  ?  㿐  `     `   @,   "     `  ?  㿐 &@     (`> `.@   @          >(`?` `.@    .`@   @  @ @ @ `(`@#@ N  ` ڰ  㿈  Mc@-耢   N :  (`
  ?c@@&@   㿐@+    + `  0  !8``:" ( + 8`@ `  Ѐ`      H@	`  + * + ` 0 8`@	*    Ѐ         㿈 @-j        @+    .  . . . . .   㿐 N ِ      `(   `(  @ *  ? 
 `    `( `         ` @
 
+   @ `   
   x(lcԚ '؂  ''''77ސؒ @,W   `    㿐    7  ?(` >@   6 ?`@(` /  .`@@(` ?6`3`3 3 2.6 @+`>` @+ @	@.3`@   3 +@@
& & & &       㿐 !  N?@*ϔȁ  㿐  N! `@,?  㿐 ! N?@*(  㿐   !b "  8@+-    8`     @+       㿐N  `- #  N@*aX    " @  #     !  b  @+     Ց `  !   N@*` 	  N  !` bڐ  x@*!Ģ  "    @*!Ĥؒ   @+ߖ    (lcԚ 	  l @  a4 
 @    (l  ?c  (`, 4   ? 3`   	  
@    N@     ph  '$`$(la4    $`(܀` ^ $`$`$`$`   $`d   
    `d` & F   @*O `   8$`8ނ $`0" $`4 `` &$`hb ! $`,@+   ab$`|$`  bb$`$`  bLbT$`$`  b\b$`$` $` 6$`$`,   2$`,$`,  N! @+a@*E  #  $`d N @)Ӓ! 0 ` "   " ` N  @)Œ! 0 N! @) 0 N! @+a    x   ( @+$  (    `       N਒! @)?0  "Ԡ ` N !  @)?0  $`    ? @(` ?3`+`@ 3`
(`
@22 2`
@ 
 *<`@, *  
*2@@

 @: *`@@@@&`@&`&@ &`,`" ``
 `` S    F  ?c =!   4@
 #  `0  |  1$ 4@)x 4   $$`0``0 @* `  
    `0&` @)  >  ` "  N "/ ` N ! ਔX!  N$ 4਒! @)?0 $@)< N਒!   @* ` ؘ `&`&` `&`&`&@ &`  㿀   `  ' h d 3      `   h@  耢      h ƀ  `@   `    "    	    `     & ? 㿀`@ `` '  '''@)`  @)      㿐     u ?  "ӣ `  !   N@( !b  @)       㿐 + ?   N  N `- b@(       "Ё  | ` N   ` ! N !` b Nb N  !  ?@(`    㿐  ? 7 N 8 ! ? N  @(M@      a      㿐@(N 8  @?   c      P   ?    ?   ` (` c@     @(      (`# (`#   (`   ݠ ې  ؐ"   "    ΐ"     @ @@```(`+ *@@@
 @(     8     @ f@@`+`       X   @ @(     :       0 E         "     ˖ u     Җ  l
 j
  (`e (`` ]* [*  X2 V2 T R P  N     @`F(`  
Q 
Q$ 
Q, 
Q@ 
QT 
Q` 
Qp 
Qx 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
R 
R 
Q 
Q 
R4 
Q 
Q 
Q 
R` 
Rh 
Q 
Q 
Rp 
Q 
Q 
Q 
R 
R 
Q 
Q 
Q 
Q 
Q 
Q 
R 
R 
Q 
Q 
R 
Q 
Q 
Q 
R 
R 
Q 
Q 
S 
Q 
Q 
Q 
S 
S  
Q 
Q 
S( 
Q 
Q 
Q 
S8 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
SD 
Q 
Q 
Q 
SL 
S` 
Q 
Q 
St 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
S 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
S 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
S 
Q 
Q 
Q 
S 
S 
Q 
Q 
S 
Q 
Q 
S 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
Q 
S㿐   .`.  ` %  ``  `瀠``" / 0``4" ..` @``  `?`   0 `  0   @@
מ  0 @@   @@&    㿈  `H`  /     L `  #`H  #`L!   h`     !b$ h`l`  #   !b#`l`@`  %  8(`@`     @ T    h@   8`@(`#@@ g      `D   P',@   `L Q N f Rb4c Y    aa 3  n#; V- RU	@ ` (` @ `  &`\ ``T	` @
 @T@  
`F4nR	%)  *  @`S	 @
 @S @ 
T	 @
 @U@ T	@բ` NcS 	  2 	   `\    ``S  " " ` $@#`@   (`P,@   # D  * "L@       `P  ,@   `` `\ْ  !!!,!,!!!!!!!!!!!!\ " `  s!.    "  װ!:հ!;Ӱ!Ѱ!ϰ!Ͱ!˰!ɰ!ǰ! Ű!@ð!A!A!C!C!D!E!F!G!H!I!J!B!K!L!M!!!!!	!!!!
!!!!!"!a!b !!7!$!%!<}!={!>y!?w!Nu!Os!Pq!Qo!Vm!Wk!Ti!Ug!Re!Sc!Za![_!X]!Y[!&Y!'W!(U!)S!*Q!+O!]M!^K!_I!` "` EH@ C!-A!.?!/= =;!59!6 " ` !4W  !1 c "  @ 
!# !* c "` ɰ!2 !# c " ` B!1 ! c "   s;! "`  s6! !!# c  !!#	 c !!# c  !!#  c  !!#  c  !!#  c  !!#  c 	 !!#  c 
 !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c  !!#  c   !!#  c " ` ;!0 !  c "  !03  !  c "`  s" "   sH@ "( " " ``    `l@% 	     P)   "+    ,@  8`@* @$@,`   	     `h"T " ",* @T`  `D @  < @          !  @ ($ X       L$D3`@;`0` X` 2    @  `h    `@ 8  (` `T @@ $D D $'쀢    @@ $D D '  @@ #`D@      'DD  `$D     s@ ["@     
Z  
ZD 
ZL 
ZT 
Z\ 
Zd 
Zl 
Zt 
Z| 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
Z 
[  
[ 
[ 
[ 
[  
[( 
[0 
[8 
[@ 
[H 
[P 
[X 
[` 
[h 
[p 
[x 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
[ 
\  
\ 
\ 
\ 
\  
\( 
\0 
\8 
\@ 
\H 
\P 
\X 
\` 
\h 
\p 
\x 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
\ 
]  
] 
] 
] 
]  
X 
]( 
]8 
]@ 
]H 
]P 
]X 
]` 
]h 
] 
] 
] 
] 
] 
^ 
^ 
^( 
^8 
^L 
^` 
^t 
^ 
^ 
^ 
^ 
^ 
^ 
_  
_ 
_( 
_< 
_P 
_d 
_x 
_ 
_ 
_ 
_ 
_ 
_ 
` 
`, 
`D 
`l 
b(㿐'  %  8@*` - "` )  +   D`T  `  *` `(   "
` @   ` `     ,    8@(`  `,`" %`T ` @       4  8@(`@ *   `  Q)  ) "1  % 8@(`@ h   @$v    %`T h `   `  " `+  s@ m"x8@(``T "`T`  
  `  8@(`@ # ,@8`T(` @%`T+ @8`T(`@  @(`8@+` ` |%    `h@  @  / h@   `  .#@ `@  `#`? " 
 
8@+`  @(@ @+`  @(@ ?   %`T `h`  "%`T s@ "x%`T 
?8@$   ׀?/ s@`    8(`@ D  `  ##@ @` $ 3`$  @ W`$        8@(`@   @   % DD  @ ِ @$ l ` s@ ΐ"8@  D  㿐 ";   ` `D    C `L7 f9 R  Y; N  ca-  /  n#' V% RK    `   ` Q(`b4 @` T@`  R%\%` @ @R @  F4an#S@/ %)   @`V @ @S@ R  @ 	 @
T   㿐  NcP@  `   `D  ;   `\'`` R#V@; f `an @V@    V; R`Fb4V.%)   @`V@ @ @S@2V#P@ Y@a@P@%)"     㿐)  +   D`P  ,    8 @(`@ `   ( `'  T  `  `
 *@ 8`@(``88 @(` "@
``$T ` #`  @ s@ # ?,   " `   % D-`P  㿐%  '  DP# "(@ D!  J@ `  )`     `8`@+    `T` @@
 -` $ D"@          @  % `h@ _?      `X` 2D  @   `hDD@ (@ D  $D  ,P  D`  @$ D*@   㿐!   @#  `   `8(`@`   @@ -      `h@  Z  @`8(`#@ @ `    `8(`@@     @  5     㿐@      @`  '  `8(`@@ $   @`  `8(`@`     D  `P+@ `8@(` D@   `T""`8@(`@  #@     `X  @       `8 @+`   ` ` @ #`T "   ` #`D   `h
   (`P㿐 @  0    s& @ `   &  s@ ?#   @ ;# &    @  &   㿐      `@ " 
    `8+` " " `     @   @  0  㿐 # "@  !`   `@  &     	& (   `8+`   ` &  & $`  	  @"r   @"y     4  & $`         " (@    +` `@  " "    " ,   `8+`       b         㿐   -   @  R     `@`     8(`@`    D  `P  +@  8`@ `TD+  ` ``@  	 8(`@`   `" 8 8(`H"    `X  㿐!   @`  #  `8(`@`     g   `8 @+``  "$`8  `8(``     #       `X  㿐!   @#         `8`<  ` @
 ,@     `<$ @(`   @ ;   $`<@  ɤ   $ @@ 3   $`<#`8  㿐 ` 
 K` 2 #  K`   0   @       s   #P & &  & & & &  & & (& ,&   @  2    㿐@Ґ @      㿐`@       s  @ 	  , `@&  (`,     2   s@  #  @  #  $  㿐  ! s"@ےc@X      b   `h   `l " ` " `   b   `h   `l   `p   `p     `@#`8     `<#`D     `H#`L     `h#`l  㿐!   @`  ! 1   8(`@`    @`    8(`@    8 @(`
#@ @`     8(`@`    @@    $ @   bx       ax       cP      㿐a    `d  㿐!   d  " $ dQ   $ d   㿐N   
`0     , `  ) !`@ , 8`@ `   `      , `  0 N `x `X`? `? "     ڢ   ע  㿐  `t t ` #`t: @       !` b !?'l#b Ȧ      !@ @ /5@ %@8`  	 `c c   /  @ @ `#`ߒ @ @}  ,` `   ? @s       @b u`jP@?O  ! b?      !c 'l t`H@'ll "O 	 vcN P@l@x u tc @  `  tbh@ #@+`  '` '`'` 
'܃,  b@      ,`% Ш %   t% ؂a% @ܚ@% %@  uU@ b^P@O 	 u vcNP@
@  u`Pj` ubP@
 bb```////?̤   ' ' ' '?̘   ' ' ' '?̣   ' ' ' '?̗   ' ' ' '?'?'?'?'?'?'?'?'?''  <  '?'?'?'?y'?''B  q'?Ж''?    g'?Ж''?  ߔ  ]'?''    T' x     x!(?''݋  '@  C,`?''  '@  8,`9   ' ' ' ,'?'?'?'?#'?'?'?'?'?   ' ' ' '?   ' ' ' '?''  ܳ  '   ' ' ' '?/?/ /?/ //?// /? ///? ///?// /  ' ' ' '??''ց   bb```'////  ??W   bb```'////  ??F  bb```'////   bb```'///~/   bb```'///p/   bb```'///b/  bb```'///U/  bb```'///H/F'Ђ C'Ђ @'Ђ ='Ђ :'Ђ 7'Ђ 4'Ђ 1'Ђ .'Ђ +'Ђ ('Ђ %'Ђ "'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 	
'Ђ 
'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ  'Ђ !'Ђ ''Ђ $'Ђ &'Ђ %'Ђ 'Ђ 'Ђ 'Ђ 'Ђ ('ރ?'
?'D  ';  '??B  '߳  '߯ '  'ཐ?'  '?'2   '3   }'  z'  v'  r'  n'"  j',  f'7  b'  _' x xaXa`` 'p't x xapa'x'| x xaa'''        ź q  " 	'Ф, q` 2   q x` 2!0   xťa  2   (' xŝa  ""'   xŖaȀ  2    ' xōaЀ    x!؂  'Ђ 0	'Ђ 'Ђ  'Ђ 0 'Ђ '
  '??ۣ '??۝?'?  '  '?  ! '?    '?   0'?   P'?  	 @'?   `'?   p'  '?'ܭ   'Ђ &'Ђ |'Ђ <'Ђ >'Ђ ='?'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ 'Ђ F'Ђ G|'Ђ 3y'Ԃ 4v'?  ?<  o'?  ?5 h' ?bb```'///[/??̀`V'     P'?>   ' ' ' D'܂ A'؂ >'؂ ;'؂ 8'?  ?  1'?  ? *' ?bb```'////??`'     '?    ' ' ' ' S !` 7 ! u v`jcN u wbc T?O 
 "O @ U`" U@ 	 @cU@ ? i   @   !# #%    %  %  %  U  b`  	l !Bc? ! b u wc@٨?U@  2 b x `! #b`bP@     !b`   !?#b ! c c%   ` %  `f` %  `¦  ?ւ`? `?@o  `  !'lW b@    !H#b x "    
x 
x 
x 
x 
yd 
x 
y 
y 
y 
z  
zP 
zt 
x 
z 
z 
z 
{  
{( 
{P 
{t 
{ 
{ 
{ 
{ 
| 
|8 
x 
|\ 
| 
| 
x 
x 
| 
} 
}( 
}@ 
}X 
}p 
} 
} 
} 
} 
~ 
~T 
~ 
~ 
 
< 
p 
x 
 
 
 
 
 
 
 
 
  
 
 
$ 
0 
< 
H 
T 
` 
l 
x 
 
 
 
 
 
 
 
 
 
 
 
 
 
  
, 
8 
D 
P 
\ 
h 
t 
 
 
 
 
 
 
 
 
 
 
 
 
 
( 
8 
P 
` 
p 
 
 
 
 
 
 
 
 
 
 
 
, 
< 
H 
  
 
 
 
 
 
 
 
x 
 
 
 
( 
@ 
X 
p 
 
 
 
 
 
 
 
 
 
  
, 
x 
8 
D 
P 
\ 
h 
t 
 
 
 
 
 
 
 
 
 
x 
 
 
$ 
X 
x 
 
 
 
 
 
x 
 
  
 
P 
x 
|p'D'    @q    f  @k    V07'' @a  C@ @(` @(`@   )   ''7@"'Ԑ 0@Ȓax  
ج    ; x! `(`    bx@    # ax@*`(@ @f @d ?  쀢  & ?? D @ 쀢  D7   '  @ :    !
   `@` 
+  
   @`2 + ` "ˢaxX   @  /0 @qu     ` "ax   @ ! `( @M  '}@Y     "
 
  V  
 
  .   @a :    !
 `@     
  @
`+ ` " *  #`#h#\#d#l#p  V!   6saxt?
    @?  ! @  0 @as  Ő  " ` ~      x   ! @  O?h   @  ! @  0 @a{     " ` ~        x   ! ڔ ` ~'    x   ! ͔ " ` "ax    x   !  " `!   x @@m @k @  /? "² ` x !  @   @[ @Y  ? "¢ ` x !    " `!   x @00 " `!   x @0?  㿀'D'HD@ (`0`H@ (`0`'@'쀠`     ' b   D`(`0`H`(`0`'@'쀠`     ' Q   H`(`0`0`(`0`''耧@    D@``H@``' '䀠`     ' 0    `'   H`(`0``(`0`'䀠`     '     '@?(@'H@``@'D@``@''@'  x'D'HD@ (`0``    D`(`0`   @ Q   H 3@ H  3`HD `@#     D@ (`0``    HD @   D````  	   H `    @   H 03` o   D@ (`0`` d   H 3@ H 3`H `    @   D`(`0`0`(`0`''܀`    ܀`    ܀`        ܀`    ܀`        HD` `HD` `HD` `HD` `D`(`0``(`0`'䀠`     (`0`   @    H(` @D(` @ `@#     ?'    '  p'D'HD@ (`0``    D`(`0`؂ `   @    H 3@ H  3`HD `ܚ@܂8 @#  !   D@ (`0``    H 3@ H 03`H `  xc@ @    
    "` #@ ?'    'ԁ  㿈'D'H'LD@ (`0`` -   L` )   D ` HL@     `  m   D`(`0``     H@     H@D`(`0`  xcH @   H' V   D@ (`0`` -   L`) )   D ` HL@ 	    `  ;   D`(`0``    H@     H@D`(`0`  xcH @   H' $   D@ (`0``    L`    D`(`0``0    D ` HL@     '     "` #@ '  @'D'H?''a* w   D@@ (`8``/ Z    @(~D@ `  .@x    `  $   D@ `  @ M    `  
    "` #@ ?'       @ !   (`0`' <   D@ `   
@u    'D@    @ (`8``     `          "` #@ ?'     @D@@ +>ȃ(`8``          `'   H `  @     `  
   H 3@ H  3` K   H `  @ >    `  
   H 3@ H 03` 8   H `  @     `  
   H 3@ H 3` %    @;    '쀠`     H ` `  @  @   H 3@ H  3` 
    "` #@ ?'    `     H`(`0`@ 
    "` #@ ?'    H3`'  㿈'D'  `x @ `       `x @  !`@@          `x  `#@   `x  `x !`  #@D  Z    `       `x @ '  `x  `x @ @|       `x @ @ `$     㿀'D'HH'D@ (`0`'䀠` ?   䀠`    䀠` 
    C   䀠`     =      @z    3@  +```@ `D `   @    +       @`    3@  `D `   @          @M    3@ D `#` 
    "` #@ ?'    '  㿀'D'HD'H   @.   D@ (`0`'䀠` Z   (` c@@    ``` 
    "` #@ ?' N   H 3@ H 03`H ```@ `   @    8   H 3@ H 03`H `D `   @    '   H 3@ H 3`H ` `   @u       H 3@ H  3`H `#` 
    "` #@ ?'    '   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
P㿈 'H7DH'D(`0``     D(`0``        @    3@ D(`0` `   @      ' $   D(`0``        @s    3@ D(`0` `   @  p    '     "` #@ ?'  x'D'HD'D@ (`0`` 	    ' `'     ' `''7@    @@ ``     
    `'ނ `7   @ &   @@ ``      '䀠`     @@ `?@```      
    'ނ `7   H0@      x 'H'L7DL` (   D(`0``  
    "` #@ ?' k   H'D(`0``     D(`0`   @?(@'    ' @  R   L(`D(`0`@ 
    "` #@ ?' C   H'D(`0`0`(`0`'쀠`      @   D(`0``(`0`'耠`     @ #@ (@+  @ `L#@     @       @L#@    @y   '  㿀'D'H'LD''7H䀧@    @@ ``     
    `' `7   H䀧@ &   @@ ``      '`     @@ `?@```      
    ' `7   L0@      㿈  @;    '쀠`      xcP @   $    `  	   @ <    '    '  P'D'HȐ    $@   H [    `     ?' N   7؂Ț `H `   @~    'D @  	a @    `     ?' 2   H 2   "7    @    '`     ?'      @    `  	   @   ?'        @)   @	   '  `'D'HȐ    $@   H     `     ?'    D @  	a  @,    `     ?'    'ā  `'D'HȐ    $@l   H     `     ?' )   D @ 0	a @    `     ?'    ``  
    "` #@ ?'    Ț `H `      'ā  ?c 'D'H'L?c @'?c @'?c @' 	#@  #` #` #` `'!#@  `#`  ' '?c @'D @      @    `  	   ??c @ @     `'  '?c @D?c @      @V    ?c @ @`  	   ??c@#@     ?c @`     `     @ `     ``  	    ``         `     @ ` 	   ??# #      ?c @`    `     @ ` 	    ``      	   ??c @ @     ?c?c@#@ ?c@#@  @ a     ``     ?c @ @ ?c@@ ?c@@  @  c''?c @D?c @      @    ?c @?c @`     ?c @` 	   ??c@#@  V   ?c @`      @   '@' 7Ȃ  7ʂ 7܂ 07@ -    `H'̂Ț ` `(   @   H L@     ?c @ @`     ?c @?# #       `x'   ?c @`      ?c@#@ ?c @ @   㿐'DD`     D @ `     D @ @*   D@        x'D'H'L'P'T'X'L'H'D   P@0    `     ?' (   \'''PPD    @    `     ?'    H @ T@ 	   X@        ?'    '܁  x'D'H'L'PH'?'L'P'D  c @    `     ?'    '܁  ?߂cX'D?ߠcܐ  @h     @ @`     ?߂cĂ @ @ -   ?ߚc܂ @?#@ ?ߚc @   xcXD@   ?ߚc @ x c`@     ?ߚc @ @`      "` #@ ?ߚc܂ @@     ?ߚcĚ@#@     ?ߚc @@    ?ߚc؂ @?ߚc @(@ ?ߚc܂ @?ߚc @  @   $    `  +   ?ߚc @   xcXD@   ?ߚc܂ @?ߚc @  @   $    `     ?ߚc܂ @@      ?ߚcĚ@#@     ?ߚc @' @ ?ߚc܂ @   #\@     L    `     ?ߚc܂ @@      ?ߚcĚ@#@     ?ߚc܂ @ `#` `4e *    #@ ?ߚc؂ @# ?ߚc܂ @   #\@          `     ?ߚc܂ @@  n    ?ߚcĚ@#@  S      @a    #@  #` 3`?ߚc܂ @   #\@          `     ?ߚc܂ @@  A    ?ߚcĚ@#@  &   ?ߚc܂ @ @   `        `     ?ߚc܂ @@  %    ?ߚcĚ@#@  
   ?ߚc܂ @?ߚcĚ@#@ ?߂cĂ @ @   㿐'D'H'LD @ HL@       㿐'DD`     D @ `     D @ @X   D@        x'D'H' 1#@  #`D( #\@     2     `     ?'     `@H  @^   '  㷀'D'H' 3#@  #` #` ` H @E   D( #\@             `'D'H'L'PА   $ @   'Ԃ +`H+````    Ԃ #`Ԃ #`DD ` `#`# Ԃ `L'ЂL     `     ؐ     `         ?'    Ђ `'P`     H`     ``#` ``#`P    `     ?'    Ђ `'L ``     L`(`0``         ``#`L`(`0` y    `     ?'    Ђ `'     ``#`КИ  # 2 D@ (`0`@   @|    `     ?' k   @    'H` 9   D @  $ @    'Ȁ`  ,   Ȁ`K    ?' N   ``H@    `̀@   D ``     ``      "` `#@ ?' ,   H` '    ``` !   Ԃ `L'Ђ `'Ph    `     P@ (`0``     
    "` #@ ?'    'ā  㿈  @    '쀠`  )   ?#@  xcp @V   $  `  	   @     '       @   $    `  	   @     '    '  `'D'HȐ H (@   ȂȂ `D       `     ?'    'ā  `'D'HȐ H (@   D @      `     ?'    ȂȂ `D   w    `     ?'    'ā  㿈'D'HH `D H `    `     ?'    '  ?c'D'H'L?c @'?c @'?c @' 	#@  #` #` #` `'!#@  `#`  ' '?c @'D `     @8    `  	   ??c| @ @ /    `'  '?c @D?c @     @    ?c @ @`  	   ??c|@#@ 	   ?c @`     `     @ `     ``  	    ``         `     @ ` 	   ??#| #      ?c @`    `     @ ` 	    ``      	   ??c| @ @     ?c?cx@#@ ?ct@#@  @ a     ``     ?ct @ @ ?ct@@ ?cx@@  @  c''?c @D?c @     @}    ?c @?c @`     ?c @` 	   ??c|@#@  n   ?c @`      X   '@' 7@ K    `db%`  @    `8`      9    `8'Ȃ `      @ 'Ȑ  z    `H'Ȃ `  O   H L@     ?c @ @`     ?c @?#| #       `t'   ?c @`   t   ?c|@#@ ?c| @ @   㿐'DD`     D ``     D `@
   D @ `     D @ @
   D@
q        㿀'D'H'LH'L`    ' 4   '䀠` )    bD@@ `(` '@ /@ (`8``  
    `' `'      :/   `&  `'   ?@(@ H'  x'D 7؂ 07ڂ؂ ` D @
   ؐ '       㿀'D'H'䀠` /   D  @	    'D@ "   耠`     耠`    䀠` 	   @ (`8``:    H@+@  `'D `'   䀠`    @ (`8``     '    ?'   x'D'H'LH'D'L`    ' 4   '` )    b@@ `(` '@ /@ (`8``  
    `' `'      ./   `&  `'   ?@(@ H'܁  x'D 7؂  7ڂ؂ ` D @
    ؐ        x'D'HH''` /   D  
@	=    'D@ "   䀠`     䀠`    ` 	   @ (`8``.    @+@  `'D `'   `    @ (`8``     '    ?'ܰ   p'D'H'LH'L`-    '    ?'?''؀` 1   D؂@@ (`0``         ''     `'        耠 	   쀣@        ??'؂ `'       耠 	   쀣@        ?耠    쀠`    ?'耠`  	      :+   `" '؀` ]   ؀@       :+   `" @' F   ؀` 2   耠`  .   쀠`
    쀠` &    
D@@ (`0`  ?c@        D `H#@L @ ܔ     `     ' +   H' '   D؂@@ (`0` |` @	    ܂ @'؂ `'    @`    (@     ?܂ @(@ H'ԁ  x'D 7؂ 7ڂ؂ ` D @   ؐ G       `'D'HH'܂?'D@ (`8``:    D `'D'Ѐ`    D  @    'D@ !   @ (`8``:    ̀ 	   'D `'D k   @ (`8``      g   ?'    @ (`8``.    Ѐ`    Ђ @@D o    `     ?'    Ђ `' |`' @   Ā`  3     ?c@ -   К @@3@ (`8``     Ђ `' $   @ (`8``:     Ȃ@@ (`8``     ?' k   Ȃ `'D    ?' b   Ђ `'q   Ѐ`     @ (`8``     ̀    Ѐ`        ?' D   '̀@    ؚ @ܘ@ؚ @@3  ؂ `'   Ђ#@ `	؀@       @܂ 0@ `"    ̂ `'؀`    ؚ @ܘ@Ԛ @@3  ؂ `'Ԃ `'   '  㿐   / `(    @  @ǐ  @a      㿐   / ̂` @ ?       㿐  㿠<        㿠     㿐'D'HDH@       㿐'D'HDH@       㿐'D'HDH@       㿐'D'HDH@       㿐'D'HDH@[       㿈'DD `'D ``      aP'   㿈'DD `'D ``      c'   㿈'DD `'D ``       a@'   㿐'DD d   㿐'DD d   㿐'DD d   㿐'DD d   㿐'DD d   㿐'DD d   㿐'DD d   㿐'DD d   㿐'DD d   㿈'D$hD@@ (`8``     D dh'    '   㿈'D$hD@@ (`8``     D dh'    '   㿈'D$hD@@ (`8``     D dh'    '   㿈'D$hD@@ (`8``     D dh'    '   㿈'D$hD@@ (`8``     D dh'    '   㿈'D$hD@@ (`8``     D dh'    '   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD dа   㿐'D'HDH'c  㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'D'HDH'c  㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'DD c   㿐'D'HDH'c  㿐'D'HDH'c  㿐'D /HDH/d́  㿐'D /HDH/d́  㿐'D /HDH/d́  㿐'D'HDH@       㿐'D'HDH@v       㿐'DD@ P        㿐'DD@ H        㿐'DD@ H        㿐'DD@ @        㿐'D'HDH@ >        㿐'D'HDH@ 4        㿈'DDD @ `@        'D@ 6   '@{   D@ /        㿈'DDD @ `@        'D@    '@b   D@         㿈'D'HD@     H@     c@    D@     H@ 3   D@  |    'DDDH @ `@     'DD @ `@ E   DDD `@ # 8`D  @    D#@ D(`@# DDH(`   @"  㿈'D'HD@ 9    H@     c@   D@ ;    H@ 3   D@  2    'DDDH @ `@ _    'DD @ `@    DDD `@ # 8`D  @    D#@ D(`@# DDH(`   @"  㿈'D#@D@       #@D@         @ 	       㿈'D#@D@       #@D@         @        㿈'D#@D@ v      #@D@         @        㿈'D#@D@ ^      #@D@         @        㿀'D'H#@D@       H'#@  @        @ N       㿀'D'H#@D@       H'#@  @        @ 2       㿀'D'H#@D@       H'#@  @        @        㿈'D'HDD ``     D `H@    DD ` `#`    #@D@ a      D H@ Z        㿈'D'HDD ``     D `H@    DD ` `#`    #@D@ <      D H@ 5        㿈'D#@D@       #@D@         @ B    `   㿈'D#@D@       #@D@         @ )    `   㿀'D#@D@        '#@  @ 8       @        㿐'DDD ` #`D `@ 7        㿐'D  㿐'D  㿐'D  㿐'D  㿐'D'HDH@ !        㿐'D'HDH@         㿈'DDDD `@ # 8`D  @        'D@  +   '@2   D@  $        㿈'DDDD `@ # 8`D  @         'D@     '@   D@          㿐'DD@          㿐'DD@          㿐'DD        㿐'DD        㿈'D'HDH @         㿈'D'HDH @         㿐'Dc   㿐'Dc   㿀'DD `'  @    #@D@          @        㿀'DD `'  @    #@D@          @         㿀'D'H'L'PDH@     'LP@    '    '@/   DH@  9   @+   '@*   '@j     㿀'D'H'L'PDH@     'LP@    '    '@   DH@     @   '@    '@@     㿐'D'H'LH`     DHL@         㿐'D'H'LH`     DHL@         㿈@'DD `'  @ !      㿈@'DD `'  @       㿈@'DD `'  @       㿈@'DD `'  @       㿈@'DD @ '  @       㿈@'DD @ '  @       㿈@'DD @ '  @       㿈@'DD @ '  @       㿐'D'HD@ $    H@         @ #@8`   㿐'D'HD@     H@        @ #@8`   㿐'D'HD@      H@        @ #@8`   㿐'D'HD@     H@        @ #@8`   㿐@'D D@       㿐@'D D@       㿐@'D D@       㿐@'D D@       㿈@'D'HDH @ (`   @'  @       㿈@'D'HDH @ (`   @'  @       㿈@'D'HDH @ (`   @'  @       㿐'DD @    㿐'DD @    㿐'DD @    㿐'DD @    㿈'D'H D@     '쀠`     H @ #@   㿈'D'H D@     '쀠`     H @ #@   㿐'D'HH   㿐'D'HH   㿐'D'HH   㿐'D'HH   㿐'D'HH   㿐'D'HH   @'D'H'LDD ``  <   DD ` `    DD ` `#`L @ 'D ` '  @ 
   D ` '؂ؐ  @    H@ 'ԚԂ#@   @       HX    #@     D    'Ԁ`     Ԃ @'     ''D@ r   'КЂ  @    '̂Đ D@    H@ ''#@   @       '̂̐ @ <     @ L0   ̐ @ E   D`  @    H@ ''#@   @       ' $   '@    ''  @ 2    @     D @    @    '@    '@    #@Dm      #@D@ 1        @    DDD `@ # 8`D  |   D @      @ $  D̐ @      @ $ D @     (`   @$   @'D'H'LDD ``  <   DD ` `    DD ` `#`L @ 'D ` '  @ 
   D ` '؂ؐ  @    H@ 'ԚԂ#@   @       HX    #@     D    'Ԁ`     Ԃ @'     ''D@ r   'КЂ  @    '̂Đ D@    H@ ''#@   @       '̂̐ @ <     @ L0   ̐ @ E   D`  @    H@ ''#@   @       ' $   '@    ''  @ 2    @     D @    @    '@    '@    #@Dm      #@D@  1        @    DDD `@ # 8`D  |   D @      @ $  D̐ @      @ $ D @     (`   @$   㿐@'DD `  @ &      㿐@'DD `  @       㿐@'DD `  @       㿐'D'HD@      H@         @ @ `?   㿐'D'HD@      H@         @ @ `?   㿈@'D'HDH @ (`   @'  @        㿐'D  㿐'D'HDH@     D @ D `D `  㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'HDH@          㿐'D'H  㿐'D'H  㿐'D'H  㿐'D'H  㿐'D'HDH@  @   㿐'D'HDH@  @   㿐'D'HDH@  @   㿐'D'HDH@  @   㿐'D'HDH  @ 4       㿐'D'HDH  @ (       㿈'D'H'LDHL @ 3       㿈'D'H'LDHL @ $       㿐'D'H'LH@         㿐'D'H'LH@         㿐'DD   㿐'DD   㿐'DD   㿐'DD   㿐'D'HDH@  @   㿐'D'HDH@  @   㿐'D'HDH@  @   㿐'D'HDH@  @   㿀@    @ '@ '  '#@  
  @           㿀@    @ '@ '  '#@  
  @           㿀@    @ '@ '  '#@  
  @           㿀@    @ '@ '  '#@  
  @           㿐'DD   㿐'DD   㿐'DD   㿐'DDD @  `'@ D   㿐'DDD @  `'@ D   㿀   @ '@ '   @          㿀   @ '@ '   @          㿐'D'H'LH(` @        㿐'D'H'LH(` @        㿐'D'H'LDHL@         㿐'D'H'LDHL@  t       㿈@    z     v    @ '#@     @  v         㿈@    ^     Z    @ '#@     @  Z         㿀@    @ '@ '  '#@   @  p         㿀@    @ '@ '  '#@   @  X         㿐  㿐  㿈'D'H'LDHL @  w       㿈'D'H'LDHL @  h       㿈@'D'H      DH @ @  t   '  V      㿈@'D'H      DH @ @  ]   '  ?      㿀@    @ '@ '  '#@  
  @  X         㿀@    @ '@ '  '#@  
  @  >         㿈'D'H'LDHL @  g       㿈'D'H'LDHL @  X       㿐'D'H'LDHL@  i       㿐'D'H'LDHL@  \       㿈@    T     P    @ '#@     @  v         㿈@    8     4    @ '#@     @  Z         㿈'D'H'LDHL @  }       㿈'D'H'LDHL @  n       㿈'D'H'LHD#@8`'(`L @(` D @ p   (`L @   㿈'D'H'LHD#@8`'(`L @(` D @ U   (`L @   㿈@'D'H      DH @  @  $   '  .      㿈@'D'H      DH @  @     '        㿐'D'H'LDHL@         㿐'D'H'LDHL@         㿐'D'H'LHD#@LD @    HD#@L @   㿐'D'H'LHD#@LD @    HD#@L @   㿐'DD `   㿐'DD @ (`8`   㿐'DD dd   㿐'DD dd   㿐'DD dd   㿐'DD dd   㿐'DD dd   㿈'DDdڂ``     D d'    '   㿐'D'HDH'dd  㿐'D'HDH'dd  㿈'DD ``    Dd̂`'     '   㿈'DD ``    Dd̂`'     '   㿈'DD ``    Dd̂`'     '   㿐'DD     @  `D     ` `D     ` `D     ` `  㿐'DD&        㿐'DD%        㿐'DD@          㿐'DD@          㿐'DD@          㿐'DD@          㿐'D'HDH@          㿐'D'HDH@          㿈'DDD @ `@ D       'D@     '@ >   D@          㿈'DDD @ `@ +       'D@     '@ %   D@          㿈'D#@D@ +      #@D@ @        @ V       㿈'D#@D@       #@D@ (        @ >       㿈'D'HDD ``     D `H@ O   DD ` `#`    #@D@ g      D H@ `        㿈'D'HDD ``     D `H@ *   DD ` `#`    #@D@ B      D H@ ;        㿀'D'H#@D@ H      H'#@  @ Q       @ _       㿐'D  㿐'D  㿐'D  㿐'D  㿐'D'HDH@ R        㿐'D'HDH@ H        㿈'DDDD `@ # 8`D  @ s       'D@  +   '@ L   D@  $        㿈'DDDD `@ # 8`D  @ T       'D@     '@ -   D@          㿐'DD@          㿐'DD@          㿐'DD        㿐'DD        㿈'D'HDH @ :        㿈'D'HDH @ .        㿈@'DD `'  @ *      㿈@'DD `'  @       㿈@'DD @ '  @       㿈@'DD @ '  @        㿐'D'HD@ 	    H@        @ #@8`   㿐'D'HD@     H@        @ #@8`   㿈'D'H D   '쀠`     H @ #@   㿈'D'H D   '쀠`     H @ #@   @'D'H'LDD ``  <   DD ` `    DD ` `#`L @ 'D ` '  @    D ` '؂ؐ  @    H@ 'ԚԂ#@   @       H@     #@     D
    'Ԁ`     Ԃ @'     ''D@    'КЂ  @ q   '̂Đ D@ j   H@ ''#@   @       '̂̐ @      @ LZ   ̐ @    D`  @ D   H@ ''#@   @       ' $   '@ ~   ''  @     @     D @ @    @ k   '@ j   '@    #@D@ P      #@D@ 1        @    DDD `@ # 8`D  @    D @ }     @ $  D̐ @ u     @ $ D @ m    (`   @$   @'D'H'LDD ``  <   DD ` `    DD ` `#`L @ 'D ` '  @    D ` '؂ؐ  @    H@ 'ԚԂ#@   @       H@     #@     D
    'Ԁ`     Ԃ @'     ''D@    'КЂ  @ q   '̂Đ D@ j   H@ ''#@   @       '̂̐ @      @ LZ   ̐ @    D `  @ D   H@ ''#@   @       ' $   '@ ~   ''  @     @     D @ @     @ k   '@ j   '@    #@D@  P      #@D@  1        @    DDD `@ # 8`D  @     D @ }     @ $  D̐ @ u     @ $ D @ m    (`   @$   㿐@'DD `  @        㿐@'DD `  @        㿐@'D D@        㿐@'D D@        㿈@'D'HDH @ (`   @'  @        㿐'DD @    㿐'DD @    㿐'D'HDH@     D @ D `D `  㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'HDH@          㿐'D'H  㿐'D'H  㿐'D'H'LH`     DHL@         㿐'D'H'LH`     DHL@         㿐'D'H  㿐'D'H  㿐'D'HDH@  @   㿐'D'HDH@  @   㿐'DD   㿐'DD   㿐'D'HDH@  @   㿐'D'HDH@  @   㿀@    @ '@ '  '#@  
  @           㿀@    @ '@ '  '#@  
  @           㿐'D'HDH  @         㿐'D'HDH  @         㿀@    @ '@ '  '#@  
  @           㿀@    @ '@ '  '#@  
  @           㿐'DD   㿐'DD   㿐'DDD @  `'@ D   㿐'DDD @  `'@ D   㿀   @ '@ '   @          㿀   @ '@ '   @          㿐'D'H'LH@         㿐'D'H'LH@         㿈@             @ '#@     @  r         㿈@             @ '#@     @  V         㿐'D'H'LH(` @        㿐'D'H'LH(` @        㿀@    @ '@ '  '#@   @  R         㿀@    @ '@ '  '#@   @  :         㿐  㿐  㿈@'D'H      DH @ @  V   '  z      㿈@'D'H      DH @ @  ?   '  c      㿀@    @ '@ '  '#@  
  @  :         㿀@    @ '@ '  '#@  
  @            㿐'D'H'LDHL@  K       㿐'D'H'LDHL@  >       㿈@             @ '#@     @  X         㿈@         |    @ '#@     @  <         㿈'D'H'LHD#@8`'(`L @(` D @    (`L @   㿈'D'H'LHD#@8`'(`L @(` D @    (`L @   㿈@'D'H  .    DH @  @  $   '        㿈@'D'H      DH @  @     '  u      㿐'D'H'LDHL@         㿐'D'H'LDHL@         㿐'D'H'LHD#@LD @    HD#@L @   㿐'D'H'LHD#@LD @ s   HD#@L @   㿐'DD `` @ 4       㿐'DD@ ]        㿐'DD```  @     㿐'DD@          㿐'DD `    㿐'DD `   㿈'D /HD`/H``     DD` `/`D```     DD` `/``   㿐'DD``   㿐'DD ` @         㿐'DD `   㿐'DD` (`0`   㿈'DD``` 	   D`$(`0`'    D`$(`0`'   㿈'DD``` 	   D`(`0`'    D`(`0`'   㿀'D'H'L'P @  L   D ``  @  U       ' @  E   '@     @  =   D ` @  h   DHLP       'D `` D   '@         㿈'D#@D@ ]      #@D@ a        @ e       㿐'DD@ u        㿐'DD@ q        㿐'D'HDH@ k        㿈'DD@        'D@     '@    D@          㿐'DD@ {        㿐'DD @   㿈'D#@D@       #@D@         @        㿐'DD@         㿐'DD@         㿐'D'HDH@         㿈'DD@        'D@     '@ Q   D@          㿐'DD@         㿐'DD@         㿐'DD@         㿐'D'HDH@         㿈'DDD @ `@        'D@    '@    D@         㿐'DD@         㿐'DD@         㿐'D'HDH@         㿈'DDD @ `@         'D@    '@    D@         㿐'DD @   㿐@'DD  @ @       㿐@'D D@       㿐'D'HDH @ @   @     㿐@'D'HD @ '  DD @  @ '@    㿈'D#@D@       #@D@         @     `   㿐'DD @  `   㿐'DD @ D@ `?   㿈'D#@D@  I       @         㿈'D#@D@  9      D @         㿐'DD @  `   㿐@'D'HD @ '  DD @  @ '@    㿐@'D D@       㿐'D'HDH @ @   `?   㿐@'DD  @ @       㿈'D'H'LDH@ 	    +`DHLL   LH@    H'    LD@    D'    L'  㿈'D'H'LDH@ 	    +c`DHLK   LH@    H'    LD@    D'    L'  㿈'D'H'LDH@ 	    ;aDHLK   LH@    H'    LD@    D'    L'  㿈'D'H#@Dc      D H@ .        㿐'D'HDH @ @   @     㿈@'D     @ @      'D @       㿐'DD @ D@ `?   㿈@'D     @ @      'D @       㿀'D#@D@  $       '#@  @         @        㿐'DDD ` #`D `@ 	        㿐@'DD `  @       㿐@'D D@       㿀'D    @ '@ '  'D   @         㿐@'DD `  @       㿈'D#@D@ F      #@D@ 1        @        㿈'D 'L'P @ 'D LP @         㿈'D#@D@       #@D@         @        x@'D  #@D{       ' '#@   @       #@Df      '  @    DD  @       @ @ @  @%  $@    㿈'D'HD@     H@     +`@    D@     H@ C   Dj    'DDDH @ `@     'DD @ `@ 5   DDD `@ # 8` (` @(` @(` @(` @  D  @ +   D#@ D  @ @ @@# DDH  @ @ @  @#   㿈'D'HDD ``     D `H@    DD ` `#`    #@D      D H@         㿈'D'H#@D*      D H@         㿐@'D'HD @ '  DD @  `'@    㿀'D#@D       '#@  @ 	       @        㿐'DDD ` #`D `@         㿐'DD @   㿐'D'HD    H       @ @ @     㿈@'D'HD@   `#@ '        㿐@'DD  @ @       㿐@'D D@       㿀  #@ @         '@ '   @        㿐'D  㿐'D  㿀'D'H H@    D @        ' @  #   '@ 8    @     D@        'D   '@ &        㿐'DD@         㿐'DD@         㿈'DD @ 'D@    ' @ ' ` @    D@         㿐@'DD  @ @       㿐@'D D@       㿀  #@ @         '@ '   @        㿐'D  㿐'D  㿀'D'H H@    D @        ' @  #   '@     @     D@        'DQ   '@         㿐'DD@         㿐'DD@ ~        㿈'DD @ 'D@    ' @ ' ` @ k   D@ k        㿐'D  㿐'D  㿐'D'HDH@ c        㿈'DDDD `@ # 8` (` @(` @(` @(` @  D  @ /       'D@     '@ 2   D@          㿐'DD@          㿐'DD        㿈'D'HDH @ <        㿐'D  㿐'D  㿐'D'HDH@ <        㿈'DDDD `@ # D  @ J       'D@     '@    D@          㿐'DD@          㿐'DD        㿈'D'HDH @ 0        㿐'D'HDH'@   㿈@'DD @ '  @       㿈@'DD `'  @       㿐'D'HD@     H@        @ @ `?   㿈'D   @ F     ' ` @ %   D@ %        㿐'D'HDH'@   㿈'D 'LDL@     '  @ %        㿈'D   @      ' ` @ O   D@ O        㿈@'D'HDH @   @ @ @   @'  @        㿐'DD @    㿐'D  㿐'D'HDH@  @   㿀'D    @ '@ '  'D   @         㿐'D'HDH@  @   㿐'D'HD@ r    H@ n       @ #@8` (` @(` @(` @(` @     㿈'D 'L'P @ 'P/D L @         㿈@'DD `'  @ X      㿈@'DD @ '  @ J      㿐'D'HD@ J    H@ F       @ #@   㿀@    @ '@ '  '#@  
  @ /         㿀   @ '@ '   @ 8        㿐'D'HD@ I    H@ E       @ #@8` (` @(` @(` @(` @     㿐'D
b   㿀'DD `'  @    #@D        ?       㿀'D'H'L'PDH@     'LP@    '    '@    DH@     @    '@    '@      㿐'D'H'LH`     DHL@         㿈'D'H D7   '쀠`     H@ 3  `3 `3`  8'D'H'LDD ``  D   DD ` `    DD ` `#`L@ 7`7`7D ` '܂ܐ     D ` 'ԂԐ     H@ 'КЂ#@   @       Hp    3@ 3`3`    D    'Ѐ`     Ђ @'     ''D@ b   'ȚȂ̐  U   'Ă DN   H@ ''#@   @       'ĂĐ @ 8     @ L^   Đ @    D `  (   H@ ''#@   @ ^      ' $   '@    ''     ̐ @     D @    @    '@    '@    #@D      #@D           DDD `@ # 8` (` @(` @(` @(` @  D     D̐ @      @ $  DĐ @      @ $ D̐ @       @ @ @   @$   㿈'D 'LDL@     '  @         㿈@'D'HDH @ @ # '        㿐'DD @    㿐'D  㿐'D'HDH'@   㿐@'D   㿈'D'H'DH@     ``  
   D@     `'      㿐'D'HD@         㿐'D'HDH@         㿐'DDD'@ DD'`  㿐'D  㿐'D  㿐'D'HDH @         㿐'D'HDH'@   㿐@'D   㿈'D'H'DH@     ``  
   D@     `'      㿐'D'HD@         㿐'D'HDH@         㿐'DDD'@ DD'`  㿐'D  㿐'D  㿐'D'HDH @         㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'H  㿐'D'HDH@ 
   D   D `'D     㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'H  㿐'D'H'LH`     DHL@ c        㿐'D'H  㿐'D'HDH@  @   㿐'DD   㿈'D'HD@ P    ' ` H@ S       '@ '   D   @ $   '@ #   '@ c      H'D'H'L'PLP@ D    ``    L  'P  '  @ F   'DD ``# 8` (` @(` @(` @(` @  쀣@
    #@D       H   'D `     쀣@ L   D  @ @ @  @DD ` @    DD  @ @ @ @# 'ԚԂ#@        H@ 'Ж'̚̂#@   @       L  'ИP@ 'ܖH@ 'ȚȂ#@   /         L  'ȂȐ @    '̘P@ 'ЂD  `@    DD#@  @ @ @  @"H  '̘'ЂD  `@    DD  @ @ @ @# L@ 'И'ܖH@ 'ĚĂ#@             D    'ĂĚ  @      @ Ă@'D@ J   '̐  =   'Ђ D6   H@ 'ܖ'#@   @ l      'L  'ܘP@ ''#@   @ W      'КD `     H@ 'ܖ'#@   @ >      ' $   '@    'ܚ'     ̐ @     D @    @    '@    '@    DD @ `   DDD `@ # 8` (` @(` @(` @(` @  D     D̐ @      @ $  DА @      @ $ D̐ @     Ȃ  @ @ @   @$   @'D'H'L'PL` F   DD ``# L@
    P@ /#@D       H@    'D `     L@ E   D `L#@DD ` @    DD `L@# L'ԚԂ#@        H@ 'Ж'̚̂#@   @       L'ĚĂ#@H @       H@ '̂̚   @        DL#@   @     DDL#@  @"H@ '̘'ЂD  `@    DD `@# H@ '̘'ЂК   @        DL    '̂̚L  @ Q     @ ̂@'D@    'ܐ     '#@D@       H@ ''#@   @       ''#@ LP@       '#@D      H@ ''#@   @       ' $   '@ q   ''  @    ܐ @     D @     @ ^   '@ ]   '@    DD @ `   DDD `@ # D     Dܐ @      @ $  D @      @ $ Dܐ @      @ Ђ@$   㿐'D'HDH@  @   㿐'DD   㿈@    @  0     @  ,    @ '#@     @          㿐'D'HDH@ ,    ``     D        D@  e        㿐'DD   㿐'D'HDH  @ q       㿈'D'H'LDHL @ r       㿐'D'H'LH@ 6        㿀@    @ '@ '  '#@  
  @ i         㿀@    @ '@ '  '#@  
  @ k         㿐'DDD @  `'@ D   㿈'D'HD@     ' ` H@        '@ c   D   @ `   '@ _   '@       㿐'D'HDH @ @   @     㿐'DDD @  @ '@ D   㿐'D  㿐'D'HDH@ Y        㿐'D'H'LH@         㿐'D'HDH @ @   @     㿐'DDD @  @ '@ D   㿐'D  㿐'D'HDH@ .        㿐'D'H'LH@ q        㿐'D'H'LH@ g        㿐'DD   @        㿈'D'H D]   '쀠`     H @ #@   㿐'D'HD    H       @ @ @     㿀  #@ @         '@ '   @        㿈'D'H#@D@       DH @         㿀  'L @ '@ '  L @        㿈'D'HDH @ @      H'    D'  㿐'D'HD@      H@         @ #@   㿈'D'H'LDHL @        㿀@    @ '@ '  '#@  
  @          㿈@'D'HDH @ @  '  ]      㿐'D'H'LDH@     ``     D    L@ (@ D@         㿈'D'H'LDHL @        㿀  'L @ '@ '  L @        㿐'D'HDH  @        㿐@'D D      㿀@    @ '@ '  '#@  
  @          㿈@ 'H'L @ '#@ HL @          㿀   @ '@ '   @         㿐'DD   㿈@'D'H      DH @  @    '        㿐'D'H'LH  @ @ @ @        㿈'D'H'LL'DH@    D   D `'D `'      㿈@    R     N    @ '#@     @ [         㿀@''D'H  @ #@ DHH    ``         D      K   D|   y        㿐'DD   @ >       㿈'D'H Dj   '쀠`     H @ #@   㿐'D'H  㿐'D'H  㿐'D'H'LH  @ @(` @ ;       㿐@'D   㿐           㿈'D'HH'D @         㿈'D'H'LL'DH    ``     D        D    `'      㿐'D'H'LDHL@         㿈@             @ '#@     @           㿐'D'HD    H       @ @ @     㿐'DDD @  `'@ D   㿐'D'H'LDHL@         㿈  'L @ '@ '  L@         㿐'D'H'LH@ ވ       㿀@    @ '@ '  '#@   @           㿈@ 'H'L @ '#@ HL@           㿐  㿈'D'H'L#@D@        DHL @         㿈@'D'H      DH @ @     '        㿐'D'H'LH  @ @(` @        㿐'D'HDDH @   @ @ @  @'  D   㿈'D'H'LDHL @         㿈@'D'H      DH @ @     '        㿐'D'H'LDH@D L@     DH@   㿈'D'H'LL@ /`HD#@D  @ ݓ        㿀  'L @ '@ '  L @         㿀@    @ '@ '  '#@  
  @           㿈@''D'H'LH`     D    L@ +@ H 'HD      D@ #@   㿐@'D   㿈'D'H'LHD'@8` (` @(` @(` @(` @  '쀠`     LD@ 7  `7 `7 D `'DL `'L '   L   㿐'D'H'LDHL@  U       㿈'D'H'LDHL @  [       㿐'D'H'LDHL@  ]       㿈  'L          @  @ L @  7       㿈@             @ '#@     @  @         㿈'D'H'L#@Di      DHL @  D       㿈'D'H'LDHL @  c       㿈'D'H'LHD#@'L#@ D@    L#@   㿈@'D'H      DH @  @  9   '  V      㿈'D'H'LHD'@8` (` @(` @(` @(` @  '쀠`     L 'L H  'H@ 7  `7 `7  '   L   㿐'D'H'LDHL@         㿐'D'H'LHD#@LD @ ܳ   HD#@L @   㿐'D'HDH@        㿐'DD `   㿐'DD `d`  `?   㿐'DD ``    D ``     6` 8cД  8c   D ``   㿐'DD `\   㿐'DD `   㿐'DD@ `        㿐'D'HHD `d'@ D ``   㿐'DDdX`   㿐'DD dİ   㿐'DD dİ   㿈'DD    ``      '    Dd͂`'   㿐'DD@         㿐'DD@         㿐'D'HDH@         㿈'DDD @ `@ &       'D@    '@ Z   D@         㿐'DD@         㿐'DD@         㿐'D'HDH@         㿈'DDD @ `@ @       'D@ 
   '@ '   D@         㿐'DD @   㿐@'D D@ .      㿐@'DD `  @ "      㿐'D'HD@ "    H@        @ @ @     㿈@'D'HD@   `#@ '  @       㿐'DD @    㿈'D'HDD ``     D `H@    DD ` `#`    #@D@        D H@         㿐@'D D@       㿐@'DD `  @       㿀@  'L#@ @         '@ '#@  L @          㿐'D'HD@     H@        @ @ `?   㿐'DD @   㿐'D'HDX    HT       @ @ @     㿈@'D'HD@   `#@ '        㿈'D'HDD ``     D `H@ [   DD ` `#`    #@D      D H@ Z        㿈'D'HDD ``     D `H@ H   DD ` `#`    #@D@  O      D H@ G        㿐'DD@ ?        㿐'DD@ ;        㿐'D'HDH@ 5        㿈'DDD @ `@ c       'D@ -   '@    D@ &        㿐'DD @   㿐@'D D@ Q      㿐@'DD `  @ E      㿐'D'HD@ E    H@ A       @ @ @     㿈@'D'HD@   `#@ '  @        㿐'DD @    㿐'DD@          㿐'DD@         㿐'D'HDH@         㿈'DD@ L       'D@     '@ T   D@          㿐'DD@ &        㿈'D'H#@D@        D H@ @        㿐'DD @   㿐@'DD  @ @ @      㿐@'D D@ 6      㿐'D'HDH @ @   @     㿐@'D'HD @ '  DD @  @ '@    㿐'DD @  `   㿈'D#@D@       #@D@         @        㿀@  'L#@ @ #        '@ '#@  L @          㿈@'D     @ @      'D @ +      㿐'DD @ D@ `?   㿈'D#@Do              㿈'D#@D_      D @          㿐'D  㿐'D  㿐'D'HDH@         㿈'DDDD `@ # 8`D  @        'D@     '@ W   D@          㿐'DD@          㿐'DD        㿈'D'HDH @         㿐'D  㿐'D  㿐'D'HDH@         㿈'DDDD `@ # 8`D  @        'D@     '@ 
   D@          㿐'DD@          㿐'DD        㿈'D'HDH @         㿐'D'HDH@  @   㿐'DD   㿈'D'H D   '쀠`     H@ 3@   @'D'H'LDD ``  <   DD ` `    DD ` `#`L@ 7D ` '  @     D ` '؂ؐ  @     H@ 'ԚԂ#@   @       H@     3@     D@     'Ԁ`     Ԃ @'     ''D@    '̚̂А  @     'Ȃ D@     H@ ''#@   @       'ȂȐ @ i     @ Ll   Ȑ @    D`  @  s   H@ ''#@   @ c      ' $   '@    ''  @ u   А @ 3    D @ @    @    '@    '@    #@DK      #@DN        @ O   DDD `@ # 8`D  @    DА @       @ $  DȐ @       @ $ DА @       @   @$   㿐'D'HDH@  @   㿐@'D   㿀@''D'H'LHD@     8`'쀠`  c   D@     @ (`0`L@ (`0`@    D@ #@     D@    D@     @ (`0`L@ (`0`@    D@ #@     D@    D@     @ (`0`L@ (`0`@    D@ #@     D@    D@ n    @ (`0`L@ (`0`@    D@ #@  l   D@     '   HD@    '䀠` )   䀣`    䀠` 8    M   䀣`     G   D@ 9    @ (`0`L@ (`0`@    D@ #@  7   D@ j   D@ "    @ (`0`L@ (`0`@    D@ #@      D@ S   D@     @ (`0`L@ (`0`@    D@ #@  	   D@ <   H@ #@   㿐'DD   㿈'D'H D   '쀠`     H @ #@   @'D'H'LDD ``  <   DD ` `    DD ` `#`L @ 'D ` '     D ` '؂ؐ     H@ 'ԚԂ#@   @       H    #@     D@     'Ԁ`     Ԃ @'     ''D@ #   'КЂ     '̂Đ Dz   H@ ''#@   @       '̂̐ m     @ Ll   ̐ @    D `  T   H@ ''#@   @       ' $   '@    ''  @     7    D @ @    @    '@    '@    #@D      #@D        @    DDD `@ # 8`D  @    D      @ $  D̐      @ $ D     (`   @$   㿈'D'H D    '쀠`     H @ #@   @'D'H'LDD ``  <   DD ` `    DD ` `#`L @ 'D ` '  @ *   D ` '؂ؐ  @    H@ 'ԚԂ#@   @ s      H    #@     D@     'Ԁ`     Ԃ @'     ''D@    'КЂ  @     '̂Đ D@     H@ ''#@   @ u      '̂̐ @       @ Ll   ̐ @    D`  @     H@ ''#@   @ O      ' $   '@    ''  @ a    @      D @ @ i   @ ճ   '@ ղ   '@    #@D/      #@D2        @ ;   DDD `@ # 8`D  @ A   D @  p     @ $  D̐ @  h     @ $ D @  `    (`   @$   㿐'D  㿐'D  㿐'D'HDH@ %        㿈'DDDD `@ # 8`D  @        'D@     '@ ӌ   D@          㿐'DD@          㿐'DD        㿈'D'HDH @         㿐'D'HDH@  @   㿐'DD   㿐'D  㿐'D  㿀'D'H H@    D @        ' @  #   '@ :    @     D@        'D   '@ (        㿐'DD@         㿐'DD@         㿈'DD @ 'D@    ' @ ' ` @    D@         㿈'D 'LDL@     '  @ ԭ        㿐'D'HDH'@   㿐@'DD  @ @       㿐@'D D@       㿀  #@ @         '@ '   @        㿐@'D   㿈@''D'H'LDH    ``     D    L @ @      D@       D@ #@   㿈'D   @ @     ' ` @ ;   D@ ;        㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'H  㿐'D'H'LH`     DHL@ p        㿐'D'H  㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'H  㿐'D'H'LH`     DHL@ G        㿐'D'H  㿀@    @ '@ '  '#@  
  @ 3         㿐'DD @    㿈'D#@D@ =      #@D@ D        @ L       㿐'D'HDH  @ R       㿀@    @ '@ '  '#@  
  @ E         㿐'DDD @  `'@ D   㿀   @ '@ '   @ ?        㿐'D'HD    H       @ #@8`   㿀@    @ '@ '  '#@  
  @          㿈'D#@D@ (      #@D@ /        @ 7       㿐'D'HDH  @ =       㿀@    @ '@ '  '#@  
  @ 0         㿐'DDD @  `'@ D   㿀   @ '@ '   @ *        㿀@    @ '@ '  '#@  
  @          㿈'D#@D@ %      #@D@ ,        @ 4       㿐'D'HDH  @ :       㿀@    @ '@ '  '#@  
  @ -         㿐'DDD @  `'@ D   㿀   @ '@ '   @ '        㿐'D'H'LH`     DHL@         㿐'D'HDH@  
   D @ D `D `  㿐'D'HDH@          㿐'D'H  㿐'D'H  㿐'D'HD@         㿐'D'HDH@         㿐'DDD'@ DD'`  㿐'D  㿐'D  㿐'D'HDH @         㿈'D'HD@     ' ` H@        '@    D   @    '@    '@       㿐'D'HDH'@   㿐@'D   㿈'D'H'DH@     ``  
   D@     `'      㿐'DDD @  @ '@ D   㿐'D'H'LH@         㿐'D'H'LH@         㿈@             @ '#@     @          㿈@'DD `'  @       㿈@'DD @ '  @       㿐'D'HD@     H@        @ #@8`   㿐'D'H'LH @ @ ϣ       㿀@    @ '@ '  '#@   @ j         㿐  㿈@    o     k    @ '#@     @ e         㿈@'DD `'  @ m      㿈@'DD @ '  @ _      㿐'D'HD@ _    H@ [       @ #@8`   㿐'D'H'LH(` @ 1       㿀@    @ '@ '  '#@   @ 8         㿐  㿈@    {     w    @ '#@     @ 3         㿈@'DD `'  @ ;      㿈@'DD @ '  @ -      㿐'D'HD@ -    H@ )       @ #@8`   㿐'D'H'LH(` @ ο       㿀@    @ '@ '  '#@   @          㿐  㿐'D'H'LH@ Μ        㿐'D  㿐'D'HDH@         㿐'D'H'LH@ ΄        㿐'DD   @         㿈'D'H Dz   '쀠`     H @ #@   㿐'D'HDH @ @   @     㿐'DDD @  @ '@ D   㿈@'D'H  2    DH @ @     '  @      㿐'D'HDH@  @   㿐'DD   㿀@    @ '@ '  '#@  
  @           㿈@'D'H      DH @ @     '        㿐'D'HDH@  @   㿐'DD   㿀@    @ '@ '  '#@  
  @           㿈@'D'H  2    DH @ @     '        㿐'D'HDH@  @   㿐'DD   㿀@    @ '@ '  '#@  
  @  z         㿐'D'H  㿐'D'H'LH  @ @(` @ x       㿐'D'H'LDHL@  t       㿈@    P     L    @ '#@     @  s         㿐'D'H'LDHL@         㿈@    )     %    @ '#@     @  ~         㿐'D'H'LDHL@         㿈@    ~     z    @ '#@     @           㿈'D'H'LHD#@8`' @L @ @ D @ T    @L @   㿈@'D'H      DH @  @  s   '        㿈'D'H'LHD#@8`'(`L @(` D @     (`L @   㿈@'D'H      DH @  @  L   '  ~      㿈'D'H'LHD#@8`'(`L @(` D @    (`L @   㿈@'D'H      DH @  @  %   '        㿐'D'H'LDHL@          㿐'D'H'LDHL@  '       㿐'D'H'LDHL@  .       㿐'D'H'LHD#@LD @ ̙   HD#@L @   㿐'D'H'LHD#@LD @ ̅   HD#@L @   㿐'D'H'LHD#@LD @ q   HD#@L @   㿈'D'H'LD `H@     ;a ;b(  ;b@ġ   D `L@     ;a ;b(  ;bPĒ   D `H@ 	    L@' @ @(`D @ @'   㿀'D @  J   D `(  @  S       ' @  C   '@ y    @  ;    @  /   D `0  @  8       ' @  (   '     @  !       D `( @  	   '@ O        㿐'DD@ t        㿐'DD@         㿐'DD@         㿐'D'HDH@         㿈'D#@D@       #@D@ #        @ '       㿐'DD @   㿐@'DD  @ @ .      㿐@'D D@ $      㿐'D'HDH @ @   @     㿐@'D'HD @ '  DD @  @ '@    㿐'DD @  `   㿐'DD@     D@         㿐'DD @ D@ `?   㿈'D#@D@  3       @  _       㿈'D#@D@  #      D @         㿈'D'H#@D@        D H@         㿐'DD @   㿐@'DD  @ @       㿐@'D D@       㿐'D'HDH @ @   `?   㿐@'D'HD @ '  DD @  @ '@    㿐'DD @  `   㿈@'D     @ @      'D @       㿐'D'HDH @ @   `?   㿈'D'H#@D      D H@         㿐'D'HDH @ @   @     㿀'D'H#@D      #@D            ``     ' @ r        H @ @   	   'D @ 3   '     㿈'DD@        'D@     '@    D@          㿐'DD@ J        㿈'D'H#@D      D H@ H        㿈'D'H#@D@        D H@ G        㿐'DD @   㿐@'DD  @ @ G      㿐@'D D@ =      㿐'D'HDH @ @   @     㿐@'D'HD @ '  DD @  @ '@    㿐'DD @  `   㿈'D#@D@       #@D@         @        㿐'D  㿐'D  㿀'D'H H@ $   D @ (       ' @     '@     @     D@  b       'DP   '@ 	        㿐@'DD  @ @ 	      㿐@'D D@        㿀  #@ @          '@ '   @         㿐'D'HDH'@   㿈'DD @ 'D@    ' @ ' ` @     D@          㿐'DDD'@ DD'`  㿈'D   @ c     ' ` @     D@          㿈'D 'LDL@      '  @ J        㿐'D'HDH'@   㿐'DDD @  @ '@ D   㿐'DD@          㿐'DD@          㿈'D 'LDL@      '  @         㿈'D 'LDL@      '  @         㿐'D'HDH'@   㿐@'DD  @ @        㿐@'D D@        㿀  #@ @          '@ '   @         㿐'D'HD@          㿐'D'HDH@          㿐'D'HDH'@   㿐@'D   㿈'D'H'DH@      ``  
   D@      `'      㿐'D  㿐'D'HDH @          㿈'D'HD@      ' ` H@         '@ c   D   @ `   '@ _   '@ ǟ      㿐'D  㿈'D'HD@      ' ` H@         '@ 9   D@  ]   @ 6   '@ 5   '@ u      㿈'D'HD@      ' ` H@         '@    D@  P   @    '@    '@ O      㿐'D'HDH'@   㿐@'D   㿈'D'H'DH@      ``  
   D@      `'      㿐'D'HDH @          㿐'D  㿐'D'HDH@          㿐'D'HDH @          㿐'D'HDH @ @   @     㿐'DDD @  @ '@ D   㿐'D'H'LH@         㿐'DD   @         㿈'D'H D
   '쀠`     H @ #@   㿐'DD   @  v       㿈'D'H D   '쀠`     H @ #@   㿐'DD   @  i       㿈'D'H D   '쀠`     H @ #@   㿐'D'HDH @ @   @     㿐'DDD @  @ '@ D   㿐'D'H'LH@ ƛ        㿐'D'H  㿐'D'H'LH@ ƌ        㿐'D'H'LH  @ @(` @ z       㿐'D'H'LH  @ @(` @ j       㿐'D'H'LH  @ @(` @ Z       㿐'DD@          㿈'DD@  '       'D@     '@    D@          㿐'DD@          㿐'DD@          㿐'D  㿈'DD @ 'D@    ' @ ' ` @  
   D        㿐'D  㿐'DD@          㿈'DD@  '       'D@     '@ ż   D@          㿐'DD@          㿐'DD@          㿐'D  㿈'DD @ 'D@    ' @ ' ` @  
   D        㿐'D  㿐'DD@          㿐'D  㿐'D'HDH@          㿈'D'H H@  <   D @      @     D@          㿐'DDD'@ DD'`  㿐'DD        㿐'D'HDH@          㿐'D'HDH@          㿐'D'H  㿐'D'HD@          㿐'D  㿐'DD@          㿐'D  㿐'DD@          㿐'D  㿐'D'HDH@          㿈'D'H H@  <   D @      @     D@          㿐'DDD'@ DD'`  㿐'DD        㿐'D'HDH@          㿐'D'HDH@          㿐'D'H  㿐'D'HD@          㿐'D  㿐'DD@          㿐'D             BitchX  Calendar        X       awk     bash    bash2   calendar        cat     csh     elm     emacs   ftp     fvwm    g++     gcc     gimp    httpd   irc     man     mutt    nc      ncftp   netscape        perl    pine    ping    sleep   slirp   ssh     sshd    startx  tcsh    telnet  telnetd tia     top     vi      vim     xdvi    xemacs  xterm   xv   x                      ( 0 8 H P X ` h p x                NMAP_ARGS       nmap %s Warning: NMAP_ARGS variable is too long, truncated      NMAP_ARG variable could not be parsed   Entering Interactive Mode because argv[0] == %s
        --interactive   --resume        Cannot resume from (supposed) log file %s       
Starting %s V. %s ( %s )
      Nmap    4.11    http://www.insecure.org/nmap/   Welcome to Interactive Mode -- press h <enter> for help
        nmap>   EOF reached -- quitting Bogus command -- press h <enter> for help
      h       help    x       q       e       .       exit    quit    Quitting by request.
   n       nmap    f       NMAP_ARGS=      --spoof Bad arguments to f!     --nmap-path             Arguments too long.     Adding to environment: %s       Failed to add NMAP_ARGS to environment  PATH    %s/%s   Could not find Nmap -- you must add --nmap-path argument        Bogus --spoof parameter About to exec %s        /dev/null       Could not exec %s       fork() failed   [PID: %d]
      Unknown command (%s) -- press h <enter> for help
       FIN     SYN     RST     RESET   PSH     PUSH    ACK     URG     Assuming %s is a username, and using the default password: %s
  %s %s ( %s )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sP: Ping Scan - go no further than determining if host is online
  -P0: Treat all hosts as online -- skip host discovery
  -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idlescan
  -sO: IP protocol scan
  -b <ftp relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
  -F: Fast - Scan only the ports listed in the nmap-services file)
  -r: Scan ports consecutively - don't randomize
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in milliseconds, unless you append 's'
  (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T[0-5]: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <time>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --data-length <num>: Append random data to sent packets
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use twice for more effect)
  -d[level]: Set or increase debugging level (Up to 9 is meaningful)
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --log-errors: Log errors/warnings to the normal-format output file
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Insecure.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enables OS detection and Version detection
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sP 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -P0 -p 80
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
      Nmap    4.11    http://www.insecure.org/nmap/   One of the host_specifications from your input file is too long (> %d chars)    anonymous                                                       -wwwuser@                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              version verbose datadir debug   help    iflist  max_parallelism max-parallelism min_parallelism min-parallelism timing  max_rtt_timeout max-rtt-timeout min_rtt_timeout min-rtt-timeout initial_rtt_timeout     initial-rtt-timeout     excludefile     exclude max_hostgroup   max-hostgroup   min_hostgroup   min-hostgroup   scanflags       defeat_rst_ratelimit    defeat-rst-ratelimit    host_timeout    host-timeout    scan_delay      scan-delay      max_scan_delay  max-scan-delay  max_retries     max-retries     oA      oN      oM      oG      oS      oH      oX      iL      iR      sI      source_port     source-port     randomize_hosts randomize-hosts osscan_limit    osscan-limit    osscan_guess    osscan-guess    fuzzy   packet_trace    packet-trace    version_trace   version-trace   data_length     data-length     send_eth        send-eth        send_ip send-ip stylesheet      no_stylesheet   no-stylesheet   webxml  rH      vv      ff      privileged      mtu     append_output   append-output   noninteractive  spoof_mac       spoof-mac       thc     badsum  ttl     allports        version_intensity       version-intensity       version_light   version-light   version_all     version-all     system_dns      system-dns      log_errors      log-errors      dns_servers     dns-servers  P           V X           v `            h          d p           h x                       M           M                                   T                                                                                       8            H            P            `            p                                                                                                                                        0            @            P            X            `            h            p            x                                                                      g           g                                                                                              (             8             H             X             h            x                                                                                                                                                                                                       0              @              P             `             p              x                                                                                                                                                    (             8             H            X                               6Ab:D:d::e:Ffg:hIi:M:m:nOo:P:p:qRrS:s:T:Vv      Bogus --max-rtt-timeout argument specified, must be at least 5  WARNING: You specified a round-trip time timeout (%ld ms) that is EXTRAORDINARILY SMALL.  Accuracy may suffer.  Bogus --min-rtt-timeout argument specified      Warning:  min-rtt-timeout is given in milliseconds, your value seems pretty large.      Bogus --initial-rtt-timeout argument specified.  Must be positive       r       Failed to open exclude file %s for reading      --excludefile and --exclude options are mutually exclusive.     Warning: You specified a highly aggressive --min-hostgroup.     --scanflags option must be a number between 0 and 255 (inclusive) or a string like "URGPSHFIN". Argument to --min-parallelism must be at least 1!       Warning: Your --min-parallelism option is pretty high!  This can hurt reliability.      --host-timeout is specified in milliseconds unless you qualify it by appending 's', 'm', 'h', or 'd'.  The value must be greater than 1500 milliseconds host-timeout is given in milliseconds, so you specified less than 15 seconds (%lims). This is allowed but not recommended.      ttl option must be a number between 0 and 255 (inclusive)       version-intensity must be between 0 and 9       Bogus --scan-delay argument specified.  --max-scan-delay cannot be negative.    max-retransmissions must be positive    data-length must be greater than 0      http://www.insecure.org/nmap/data/nmap.xsl      HTML output is not directly supported, though Nmap includes an XSL for transforming XML output into HTML.  See the man page.    %s.nmap %s.gnmap        %s.xml  !!Greets to Van Hauser, Plasmoid, Skyper and the rest of THC!!
 Only one input filename allowed -       Failed to open input file %s for reading        ERROR: -iR argument must be the maximum number of random IPs you wish to scan (use 0 for unlimited)     Data payload MTU must be >0 and multiple of 8   Unknown long option (%s) given@#!$#$    Your argument to -b is b0rked. Use the normal url style:  user:pass@server:port or just use server and use default anon login
  Use -h for help
        me      Can only use 'ME' as a decoy once.
     You are only allowed %d decoys (if you need more redefine MAX_DECOYS in nmap.h) Failed to resolve decoy host: %s (must be hostname or IP address)       WARNING: a source port of zero may not work on all systems.     WARNING: identscan (-I) no longer supported.  Ignoring -I
      Argument to -M must be at least 1!      Warning: Your max-parallelism (-M) option is extraordinarily high, which can hurt reliability   Bogus argument to -PS: %s       Bogus argument to -PB: %s       Bogus argument to -PU: %s       -PO (the letter O)? No such option. Perhaps you meant to disable pings with -P0 (Zero). Illegal Argument to -P, use -P0, -PI, -PB, -PE, -PM, -PP, -PA, -PU, -PT, or -PT80 (or whatever number you want for the TCP probe destination port)      Only 1 -p option allowed, separate multiple ranges with commas. You can only use the source option once!  Use -D <decoy1> -D <decoy2> etc. for decoys
  IPv4    IPv6    Failed to resolve/decode supposed %s source address %s. Note that if you are using IPv6, the -6 argument must come before -S    An option is required for -s, most common are -sT (tcp scan), -sS (SYN scan), -sF (FIN scan), -sU (UDP scan) and -sP (Ping scan)        No scan type 'B', did you mean bounce scan (-b)?        Scantype %c not supported
      Paranoid        Sneaky  Polite  Normal  Aggressive      Insane  Unknown timing mode (-T argument).  Use either "Paranoid", "Sneaky", "Polite", "Normal", "Aggressive", "Insane" or a number from 0 (Paranoid) to 5 (Insane)     
%s version %s ( %s )
  Unable to get current localtime()#!#    %Y-%m-%d %H:%M %Z       Unable to properly format time  
Starting %s %s ( %s ) at %s
   Happy %dth Birthday to Nmap, may it live to be %d!
     The fast scan (-F) is incompatible with ping scan       Your port specification string is not parseable You can specify fast scan (-F) or explicitly select individual ports (-p), but not both You cannot use -F (fast scan) or -p (explicit port selection) with PING scan or LIST scan       0       Bogus --spoof-mac value encountered (%s) -- only up to 6 bytes permitted        Could not parse as a prefix nor find as a vendor substring the given --spoof-mac argument: %s.  If you are giving hex digits, there must be an even number of them.     No registered vendor    Spoofing MAC address %02X:%02X:%02X:%02X:%02X:%02X (%s)
        WARNING: a TCP scan type was requested, but no tcp ports were specified.  Skipping this scan type.      WARNING: UDP scan was requested, but no udp ports were specified.  Skipping this scan type.     WARNING: protocol scan was requested, but no protocols were specified to be scanned.  Skipping this scan type.  Could not figure out what device to send the packet out on with the source address you gave me!  If you are trying to sp00f your scan, this is normal, just give the -e eth0 or -e ppp0 or whatever.  Otherwise you can still use -e, but I find it kindof fishy.       I cannot figure out what source address to use for device %s, does it even exist?       Failed to resolve ftp bounce proxy hostname/IP: %s
     Resolved ftp bounce attack proxy to %s (%s).
   <?xml-stylesheet href="%s" type="text/xsl"?>
   <?xml version="1.0" ?>
%s<!--   #       %s %s scan initiated %s as:     %s      -->     
       <nmaprun scanner="nmap" args="  %s"     start="%lu" startstr="%s" version="%s" xmloutputversion="1.01">
        <verbose level="%d" />
<debugging level="%d" />
        If you want me to fake your argv, you need to call the program with a longer name.  Try the full pathname, or rename it fyodorssuperdedouperportscanner pine    WARNING:  Your specified max_parallel_sockets of %d, but your system says it might only give us %d.  Trying anyway
     The max # of sockets we are using is: %d
       --------------- Timing report ---------------
    hostgroups: min %d, max %d
     rtt-timeouts: init %d, min %d, max %d
          scan-delay: TCP %d, UDP %d
     parallelism: min %d, max %d
    max-retries: %d, host-timeout: %ld
   ---------------------------------------------
  No target machines/networks specified!  <host>  </host>
        Cannot get hostname!  Try using -S <my_IP_address> or -e <interface to scan through>
   WARNING:  We could not determine for sure which interface to use, so we are guessing %s .  If this is wrong, use -S <my_IP_address>.
   Do not have appropriate device name for target  Skipping host %s due to host timeout
   Host: %s (%s)	Status: Timeout   Final times for host: srtt: %d rttvar: %d  to: %d
              Could not mmap() %s read/write  Output file %s is too short -- no use resuming   as:    Unable to parse supposed log file %s.  Are you sure this is an Nmap output file?        Unable to parse supposed log file %s.  Sorry    Unable to parse supposed log file %s.  Perhaps the Nmap execution had not finished at least one host?  In that case there is no use "resuming"  nmap --append-output    0verfl0w        --randomize-hosts       WARNING:  You are attempting to resume a scan which used --randomize-hosts.  Some hosts in the last randomized batch make be missed and others may be repeated once     
Host:  
Interesting ports on   
All     scanned ports on       Unable to parse ip (%s) supposed log file %s.  Sorry    Warning: You asked for --resume but it doesn't look like any hosts in the log file were successfully scanned.  Starting from the beginning.     Problem setting socket SO_LINGER, errno: %d
    setsockopt      init_socket: Problem binding source address (%s), errno :%d
    bind    Ports to be scanned must be between 0 and 65535 inclusive       Error #485: Your port specifications are illegal.  Example of proper form: "-100,200-1024,T:3000-4000,U:60000-" Error #486: Your port specifications are illegal.  Example of proper form: "-100,200-1024,3000-4000,60000-"     Error #487: Your port specifications are illegal.  Example of proper form: "-100,200-1024,3000-4000,60000-"     WARNING:  Duplicate port number(s) specified.  Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm).    Error #488: Your port specifications are illegal.  Example of proper form: "-100,200-1024,3000-4000,60000-"     No ports specified -- If you really don't want to scan any ports use ping scan...       Nmap Interactive Commands:
n <nmap args> -- executes an nmap scan using the arguments given and
waits for nmap to finish.  Results are printed to the
screen (of course you can still use file output commands).
! <command>   -- runs shell command given in the foreground
x             -- Exit Nmap
f [--spoof <fakeargs>] [--nmap-path <path>] <nmap args>
-- Executes nmap in the background (results are NOT
printed to the screen).  You should generally specify a
file for results (with -oX, -oG, or -oN).  If you specify
fakeargs with --spoof, Nmap will try to make those
appear in ps listings.  If you wish to execute a special
version of Nmap, specify --nmap-path.
n -h          -- Obtain help with Nmap syntax
h             -- Prints this help screen.
Examples:
n -sS -O -v example.com/24
f --spoof "/usr/local/bin/pico -z hello.c" -sS -oN e.log example.com/24

  TCP Sequence Prediction: Class=%s
                         Difficulty=%d (%s)
  Worthy challenge        Good luck!      Formidable      Medium  Easy    Trivial joke    constant sequence number (!)    64K rule        trivial time dependency increments by 800       random positive increments      truly random    unknown class   ERROR, WTF?     Duplicated ipid (!)     Incremental     Broken little-endian incremental        Randomized      Random positive increments      All zeros       Busy server or unknown class    zero timestamp  2HZ     100HZ   1000HZ  none returned (unsupported)     Unknown Scan Type       Host Discovery  ACK Scan        SYN Stealth Scan        FIN Scan        XMAS Scan       UDP Scan        Connect() Scan  NULL Scan       Window Scan     RPCGrind Scan   Maimon Scan     IPProto Scan    Ping Scan       ARP Ping Scan   Idle Scan       Bounce Scan     Service Scan    OS Scan %s:%u: failed assertion `%s'
   nmap.cc open    filtered        UNfiltered      closed  open|filtered   closed|filtered unknown Attempting connection to ftp://%s:%s@%s:%i
     Couldn't create ftp_anon_connect socket Your ftp bounce proxy server won't talk to us!
 Connected:      %s      recv problem from ftp bounce server     USER %s
       sent username, received: %s     Your ftp bounce server doesn't like the username "%s"
  PASS %s
       recv problem from ftp bounce server
    Timeout from bounce server ...  sent password, received: %s     Your ftp bounce server refused login combo (%s/%s)
     Login credentials accepted by ftp server!
      waiting to reap child   success failure 
[%d finished status=%d (%s)]
nmap>     caught SIGINT signal, cleaning up
      caught SIGTERM signal, cleaning up
     caught SIGHUP signal, cleaning up
      caught SIGSEGV signal, cleaning up
     caught SIGBUS signal, cleaning up
      caught signal %d, cleaning up
  %s/%s   NMAPDIR %s/.nmap/%s     /usr/local/share/nmap   ./%s    Warning: File %s exists, but Nmap is using %s for security and consistency reasons.  set NMAPDIR=. to give priority to files in your local directory (may affect the other data files too).     Fetchfile found %s
     vector::reserve HOST_UP HOST_DOWN       HOST_FIREWALLED UNKNOWN/COMBO   yes     no      Hostupdate called for machine %s state %s -> %s (trynum %d, dotimeadj: %s time: %ld)
   %s:%u: failed assertion `%s'
   targets.cc      hostnum <= pt->group_end        tqi->sockets_out > 0    Decreasing massping group size from %f to       %f
     pt->block_tries > 0 || pt->down_this_block > 0  pt->block_unaccounted > 0       newstate == HOST_UP     ?      fluxx0red       ARP ping: Considering %s UP because it is a local IP, despite no MAC address for device %s
     ARP ping: Considering %s DOWN because no MAC address found for device %s.
      hs->next_batch_no > 0   checksocklen >= sizeof(struct sockaddr_in)      exclude file not supported for IPV6 -- If it is important to you, send a mail to fyodor@insecure.org so I can guage support
    %d byte micro packet received in get_ping_results       Supposed ping packet is only %d bytes long!     Ping sequence %hu leads to hostnum %d which is beyond the end of this group (%d)        We got a ping packet back from %s: id = %d seq = %d checksum = %d
      ICMP type %d code %d packet is only %d bytes
   ICMP (embedded) type %d code %d packet is only %d bytes
        Got ICMP error referring to ICMP msg which we did not send      Illegal id %d found, should be %d (icmp type/code %d/%d)        Bogus trynum, sequence number or unexpected IP address in ICMP error message
   Got ICMP error referring to TCP msg which we did not send       Bogus trynum %d Whacked seq number from %s      Got ICMP error referring to UDP msg which we did not send       Got ICMP response to a packet which was not TCP, UDP, or ICMP   hostnum <= (u32) pt->group_end  Got destination unreachable for %s
     Got Time Exceeded for %s
       Got ICMP source quench
 Got ICMP message type %d code %d
       TCP packet is only %d bytes, we can't get enough information from it
   Warning, unexpected packet from machine %s      Response from host beyond group_end     TCP ping response from unexpected host %s
      We got a TCP ping packet back from %s port %hi (hostnum = %d trynum = %d
       In response to UDP-ping, we got UDP packet back from %s port %hi (hostnum = %d trynum = %d
     Found whacked packet protocol %d in get_ping_results    tqi->sockets_out <= max_sockets sendconnecttcpquery: Scavenging a free socket due to serious shortage
  sendconnecttcpquery: Could not scavenge a free socket!  tqi->sockets[probe_port_num][seq] == -1 Socket creation in sendconnecttcpquery  Unable to get target sock in sendconnecttcpquery        Got ENETUNREACH from sendconnecttcpquery connect()          sendpingquery: unknown pingtype: %d     sendto in sendpingquery returned %d (should be 8)!
     sendto: %s
     WRITE selected for machine %s
  READ selected for machine %s
   EXC selected for machine %s
    Machine %s MIGHT actually be listening on probe port %d
        Strange read error from %s      %s: %s
 Machine %s is actually LISTENING on probe port %d
      WARNING: getconnecttcpscanresults is taking way too long, skipping      tqi->sockets_out == 0   Exclude file line %d was too long to read.  Exiting.    	
      ,       Loaded exclude target of: %s
   exclude host group %d is %s/%d
 exclude host group %d is %s
    IPV6 addresses are not supported in the exclude file
   Unknown target type in exclude file.
   Socket trouble in massping      dnet: Failed to open device %s  socket trobles in massping      (icmp and dst host %s) or ((tcp or udp) and dst host %s and ( dst port %d or dst port %d or dst port %d or dst port %d or dst port %d)) Finished block: srtt: %d rttvar: %d timeout: %d block_tries: %d up_this_block: %d down_this_block: %d group_sz: %d
     massping done:  num_hosts: %d  num_responses: %d
       ?.H?      @       nexthost        %s: failed to determine route to %s     %s: Failed to determine dst MAC address for target %s   vector::reserve TCP     tcp     UDP     udp     IP      ip      UNKNOWN unknown Bogus parameter passed to ll2shortascii %.3fMB  %.3fKB  %uB     A.    @@     getFinalPacketStats called with woefully inadequate parameters  Raw packets sent: %llu (%s) | Rcvd: %llu (%s)   Packet tracer: Arp packets must be at least 42 bytes long.  Should be exactly that length excl. ethernet padding.       who-has %s tell %s      reply %s is-at %02X:%02X:%02X:%02X:%02X:%02X    SENT    RCVD    %s (%.4fs) ARP %s
      @@                                                                     BOGUS!  IP Version in packet is not 4   BOGUS!  Packet too short.       +                frag offset=%d%s       ttl=%d id=%d iplen=%d%s TCP %s:?? > %s:?? ?? %s (incomplete)     ack=%lu        TCP %s:?? > %s:?? %s %s %s      seq=%lu (incomplete)    TCP %s:%d > %s:%d ?? %s %s      TCP %s:%d > %s:%d ?? %s %s (incomplete) seq=%lu win=%hi TCP %s:%d > %s:%d %s %s %s      UDP %s:?? > %s:?? fragment %s (incomplete)      UDP %s:%d > %s:%d %s    ICMP %s > %s fragment %s (incomplete)   Echo reply      network unreachable     host unreachable        protocol unreachable    port unreachable        fragmentation required  source route failed     destination network unknown     destination host unknown        source host isolated    destination network administratively prohibited destination host administratively prohibited    network unreachable for TOS     host unreachable for TOS        communication administratively prohibited by filtering  host precedence violation       precedence cutoff in effect     unknown unreachable code        source quench   network redirect        host redirect   unknown redirect        Echo request    TTL=0 during transit    TTL=0 during reassembly TTL exceeded (unknown code)     IP header bad   Misc. parameter problem Timestamp request       Timestamp reply Information request     Information reply       Address mask request    Address mask reply      Traceroute      Domain name request     Domain name reply       Security failures       Unknown type    ICMP %s > %s %s (type=%d/code=%d) %s    Unknown protocol (%d): %s       Packet tracer: tiny packet encountered  %s (%.4fs) %s
  @@     %s:%u: failed assertion `%s'
   tcpip.cc        proto == IPPROTO_TCP || proto == IPPROTO_UDP    Connected       %s      Failed to convert target IPv4 address to presentation format!?! sin->sin_family == AF_INET6     CONN (%.4fs) %s localhost > %s:%d => %s
        @@     Failed to convert target address to presentation format in inet_socktop!?!  Error: %s   ss      sslen   result->ai_addrlen > 0 && result->ai_addrlen <= (int) sizeof(struct sockaddr_storage)   Call to pcap_open_live(%s, %d, %d, %d) failed three times. Reported error: %s
There are several possible reasons for this, depending on your operating system:
LINUX: If you are getting Socket type not supported, try modprobe af_packet or recompile your kernel with SOCK_PACKET enabled.
*BSD:  If you are getting device not configured, you need to recompile your kernel with Berkeley Packet Filter support.  If you are getting No such file or directory, try creating the device (eg cd /dev; MAKEDEV <device>; or use mknod).
SOLARIS:  If you are trying to scan localhost and getting '/dev/lo0: No such file or directory', complain to Sun.  I don't think Solaris can support advanced localhost scans.  You can probably use "-P0 -sT localhost" though.

   pcap_open_live(%s, %d, %d, %d) FAILED. Reported error: %s.  Will wait %d seconds then retry.    @      NULL or zero-length hostname passed to resolve()        eth_open_cached() called with NULL device name! eth_open_cached() called with empty device name!        victim  source  build_tcp_raw() called with an option length argument of %d which is illegal because it is not divisible by 4   headerlen <= (int) packetlen    headerlen >= 20 && headerlen <= 60      mtu > 0 && mtu % 8 == 0 Warning: fragmentation (mtu=%i) requested but the payload is too small already (%i)     sendto in %s: sendto(%d, packet, %d, 0, %s, %d) => %s   Sleeping %d seconds then retrying       packet  (int) packetlen > 0     send_ip_packet: Failed to open ethernet device (%s)     sd >= 0 send_ip_packet  Unknown icmp type/code (%d/%d) in build_icmp_raw        readtcppacket: packet is NULL!
 Packet is fragmented, offset field: %u
 TCP packet: %s:%d -> %s:%d (total: %d bytes)
   Flags:  (none)  RST     SYN     ACK     PSH     FIN     URG     
       ipid: %hu ttl: %hu      Seq: %u	Ack: %u
        Seq: %u
        Ack: %u
        Data portion:
  %2X%c   readudppacket: packet is NULL!
 UDP packet: %s:%d -> %s:%d (total: %d bytes)
   ttl: %hu        build_udp_raw: One or more of your parameters suck!
    send_ip_raw: One or more of your parameters suck!
      NULL packet device passed to readip_pcap        WARNING: Negative timeout value (%lu) passed to readip_pcap() -- using 0        Cannot obtain datalink information: %s  FATAL: readip_pcap: bogus caplen from libpcap (%d) on interface type %d FATAL:  Unknown datalink type (%d). Caplen: %d; Packet:
        offset < MAX_LINK_HEADERSZ      Unable to realloc %d bytes of mem       head.ts.tv_sec  NmapArpCache() can only take IPv4 addresses.  Sorry     command == ARPCACHE_SET read_arp_reply_pcap     NULL packet device passed to readarp_reply_pcap WARNING: Negative timeout value (%lu) passed to %s() -- using 0 readarp_reply_pcap called on interfaces that is datatype %d rather than DLT_EN10MB (%d)                  doArp   %s can only handle IPv4 addresses       arp and ether dst host %02X:%02X:%02X:%02X:%02X:%02X    %s: failed to open device %s      WARNING: %s: eth_send of ARP packet returned %u rather than expected %d bytes
  %s: Received -1 response from readarp_reply_pcap        setTargetNextHopMAC     %s: Failed to determine nextHop to target       Failed to lookup subnet/netmask for device (%s): %s     set_pcap_filter called with too-large filter arg
       Packet capture filter (device %s): %s
  Error compiling our pcap filter: %s
    Failed to set the pcap filter: %s
      WARNING: Unable to find appropriate interface for system route to %s
   getinterfaces   socket in getinterfaces Failed to determine your configured interfaces!
        getinterfaces: SIOCGIFCONF claims you have no network interfaces!
      Failed to determine the netmask of %s!  Failed to get IF Flags for device %s    %s: Failed to open ethernet interface (%s). A possible cause on BSD operating systems is running out of BPF devices (see http://seclists.org/lists/nmap-dev/2006/Jan-Mar/0014.html).    %s: Failed to obtain MAC address for ethernet interface (%s)    mydevs  getInterfaceByIP        %s called with non-IPv4 address getsysroutes    /proc/net/route r        	
     Could not find interface in /proc/net/route line        Failed to determine Destination from /proc/net/route    Failed to determine gw for %s from /proc/net/route
     Failed to find field %d in /proc/net/route      Failed to determine mask from /proc/net/route   Failed to find device %s which was referenced in /proc/net/route        %s: route_open() failed %s: route_loop() failed NULL howmany ptr passed to getsysroutes()       route_nfo passed a NULL dst address     Sorry -- route_dst currently only supports IPv4 Could not find interface %s which was specified by -e   Problem setting large socket receive buffer     Our buffer size is now %d
      setrlimit RLIMIT_NOFILE failed  Failed to secure socket broadcasting permission
        setsockopt      recv in recvtime        select() in recvtime    packetbuf == NULL       ipv4->ip_v == 4 len >= 20       len == (u32) ntohs(ipv4->ip_len)        len == 42       
QUITTING!
     
       : %s (%d)
      Here it is:
    %-2X    
               ................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.................................................................................................................................        
	       %04x    %02x           %c%c    %c       %02x                                          %c       Bogus call to numerlist2array() -- destsize must be a multiple of 2     Buffer would overflow -- too many numbers in provided list      Alleged number begins with nondigit!  Example of proper form: "20,80,65532"     Number given in list is outside given legal range       Bogus character in supposed number-list string. Example of proper form: "20,80,65532"   %s:%u: failed assertion `%s'
   utils.cc        argv[0] == (char *) 0x123456        Received IPID zombie probe response which probably came from an earlier prober instance ... increasing rttvar from %d to %d     Received unexpected response packet from %s during ipid zombie probing: ?333333        initialize_idleproxy    %s:%u: failed assertion `%s'
   idle_scan.cc    proxy   proxyName       Invalid port number given in IPID zombie specification: %s      Could not resolve idlescan zombie host: %s      Unable to find appropriate source address and device interface to use when sending packets to %s        %s: Failed to determine dst MAC address for Idle proxy  %s: Failed to open ethernet device (%s) socket trobles in %s    tcp and src host %s and dst host %s and src port %hu    Received unexpected response packet from %s during initial ipid zombie testing  Idlescan zombie %s (%s) port %hu cannot be used because it has not returned any of our probes -- perhaps it is down or firewalled.      Idlescan using zombie %s (%s:%hu); Class: %s
   Idlescan zombie %s (%s) port %hu cannot be used because IPID sequencability class is: %s.  Try another proxy.   idlescan initial zombie qualification test: %d probes sent, only %d returned    Your IPID Zombie (%s; %s) is behaving strangely -- suddenly cannot obtain IPID  Your IPID Zombie (%s; %s) is behaving strangely -- suddenly cannot obtain valid IPID distance.  Even though your Zombie (%s; %s) appears to be vulnerable to IPID sequence prediction (class: %s), our attempts have failed.  This generally means that either the Zombie uses a separate IPID base for each host (like Solaris), or because you cannot spoof IP packets (perhaps your ISP has enabled egress filtering to prevent IP spoofing), or maybe the target network recognizes the packet source as bogus and drops them       WARNING: IPID spoofing test sent 4 packets and expected a distance of 5, but instead got %d     @>      @(              adjust_idle_timing: tested/true %d/%d -- old grpsz/delay: %f/%d         adjust_idle_timing: testcount: %d  realcount: %d -- old grpsz/delay: %f/%d      WARNING: Idlescan has erroneously detected phantom ports -- is the proxy %s (%s) really idle?   -> %f/%d
       ?陙??񙙙idlescan_countopen2     In preparation for idlescan probe try #%d, sleeping for %d usecs        idlescan_countopen2: Must have lost a sent packet because ipid_dist is %d while proxyprobes_sent is %d. idlescan_countopen2: Counted %d open ports in try #%d, but counted %d earlier ... probably a proxy_probe problem        idlescan_countopen2: Sent %d probes; only %d responses.  Slowing scan.  idlescan_countopen2:  found %d open ports (out of %d) in %lu usecs      ?ffffffidlescan_countopen: In try #%d, counted %d open ports out of %d.  Retrying      Idlescan is unable to obtain meaningful results from proxy %s (%s).  I'm sorry it didn't work out.      idlescan_countopen: %d ports found open out of %d, starting with %hu    idle_treescan: Called against %s with %d ports, starting with %hu. expectedopen: %d     IDLESCAN TIMING: grpsz: %.3f delay: %d srtt: %d rttvar: %d
     Adjusting timing -- idlescan_countopen correctly found %d open ports (out of %d, starting with %hu)     Adjusting timing because my first scan of %d ports, starting with %hu found %d open, while second scan yielded %d       Adjusting timing because my first scan of %d ports, starting with %hu found %d open, while second scan yeilded %d       Idlescan requires a proxy host  idle_scan(): You are not allowed to change proxies midstream.  Sorry    target  Skipping Idle Scan against %s -- you can't idle scan your own machine (localhost).
     Initiating Idlescan against %s
 second  seconds The Idlescan took %ld %s to scan %d ports.
     send_closedudp_probe: One or more of your parameters suck!
     send_ip_packet in send_closedupd_probe  Resp    Y       DF      N       W       %hX     ACK     S++     S       O       Flags   Ops     fingerprint_portunreach handed a non-ICMP packet!       TOS     IPLEN   RIPTL   RIPCK   0       E       F       UCK     ULEN    DAT     get_fingerprint %s: Failed to open ethernet device (%s) socket troubles in get_fingerprint      Wait time is %dms
      dst host %s and (icmp or (tcp and src host %s)) For OSScan assuming port %lu is open, %d is closed, and neither are firewalled
 
	
????          Got packet for test number %d
  T7      PU      T6      T5      T4      T3      T2      T1      We only got %d bytes out of %d on our ICMP port unreachable packet, skipping    WARNING:  RST from port %lu -- is this port really open?
       Unable to associate os scan response with sent packet (received ack: %lX; sequence base: %lX. Packet:   The avg TCP TS HZ is: %f
       Ignoring claimed uptime of %lu days     TSeq    Class   C       Val     %X      64K     i800    TD      gcd     SI      RI      TR      IPID    I       BI      RPI     RD      Z       TS      2HZ     100HZ   1000HZ  U       Insufficient responses for TCP sequencing (%d), OS detection may be less accurate
              A      A.    @333333@U@     @\     @      @0     ?      A      Observed fingerprint lacks a classification
    Warning: Classification of observed fingerprint does not appear in reference fingerprint.
      +       %s:%u: failed assertion `%s'
   osscan.cc       referenceFP     observedFP      Test %s differs in %li attributes
      num_subtests_succeeded <= num_subtests  A              FP      FPR     accuracy_threshold >= 0 && accuracy_threshold <= 1      Bogus list insertion state (%d) -- num_matches = %d num_perfect_matches=%d entrance_requirement=%f              ?      >hInitiating OS Detection against %s at %.3fs
    Skipping OS Scan due to absence of open (or perhaps closed) ports
      Warning:  OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
        Failed exact match #%d (0-based):
%s    WARNING:  OS didn't match until the try #%d     Completed OS Detection against %s at %.3fs (took %.3fs)
        @@     ?333333        ?      %%M=%02X%02X%02X        SInfo(V=%s%%P=%s%%D=%d/%d%%Tm=%X%%O=%d%%C=%d%s)
        4.11    sparc-sun-solaris2.8    (None)  (Too many)      mergeFPs was handed a pointer to null fingerprint       end - p > 100   FingerPrint  %s
        OS name too long        p-str < (int) sizeof(str) - 30  Class   Bogus line #%d (%s) passed to parse_classline() Too many Class lines in fingerprint (line %d: %s), remove some or increase MAX_OS_CLASSIFICATIONS_PER_FP        Parse error on line %d of fingerprint: %s
       |      Parse error with AVal string (%s) in nmap-os-fingerprints file  Parse error on line %d of fingerprint: %s       Fingerprint     
#      Parse error line line #%d of fingerprint        r       Unable to open Nmap fingerprint file: %s        FingerPrint     Parse error on line %d of nmap-os-fingerprints file: %s
        FingerPrint     Too many OS fingerprints -- 0verfl0w    nmap-os-fingerprints    OS scan requested but I cannot find nmap-os-fingerprints file.  It should be in %s, ~/.nmap/ or .       /usr/local/share/nmap   numSamples < (int) (sizeof(ipid_diffs) / 2)     normal  machine $Cr!pT |<!dd!3  XML     !|1      product="       version="       extrainfo="     hostname="      ostype="        devicetype="    servicefp="     rpcnum="%li" lowver="%i" highver="%i" proto="rpc"      unknown tunnel="ssl"            table   probed  <service name="%s"%s %smethod="%s" conf="%d"%s />       INTERFACES: NONE FOUND(!)
      DEV     (SHORT) IP/MASK TYPE    UP      MAC     (%s)    %s/%d   ethernet        %02X:%02X:%02X:%02X:%02X:%02X   loopback        point2point     other   up      down    ************************INTERFACES************************
     %s
     ROUTES: NONE FOUND(!)
  DST/MASK        GATEWAY %s:%u: failed assertion `%s'
   output.cc       nbits <= 32     **************************ROUTES**************************
     ssl/    %s?     %s      <ports> <extraports state="%s" count="%d" />
   The     All     port    ports   is      are     %s %d scanned %s on %s %s        or     %s (%d) 
       Host: %s (%s)	Status: Up        </ports>
       protocols       Interesting %s on %s:
  Host: %s (%s)   Not shown:      ,       %d %s %s        numrows > 0     PROTOCOL        PORT    STATE   SERVICE VERSION Protocols       Ports   	%s:    %-24s   %d      %d/%s/%s/       <port protocol="ip" portid="%d"><state state="%s" />    
<service name="%s" conf="8" method="table" />  </port>
        tcp     udp     %d/%s   (RPC (Unknown Prog #))  R       N       (%s:%li*%i-%i)  (#%li (unknown) V%i-%i) (%s V%i)        (%s V%i-%i)     Unknown rpc_status %d           %s%s%s  %d/%s/%s/%s/%s/%s/%s/   <port protocol="%s" portid="%d">        <state state="%s" />    <owner name="%s" />     	Ignored State: %s (%d) s       %d service%s unrecognized despite returning data. If you know the service/version, please submit the following fingerprint%s at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
 ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
     &lt;    &gt;    &amp;   &quot;  &apos;  &#45;   end - p > 1     log_vwrite      fileidx < LOG_NUM_FILES vnsprintf returned %d in %s -- bizarre. Quitting.
      %s: write buffer not large enough -- need to increase from %d to at least %d (logt == %d).  Please email this message to fyodor@insecure.org.  Quitting.
       Failed to write %d bytes of data to (logt==%d) stream. fwrite returned %d.  Quitting.
  log_vwrite(): Passed unknown log type (%d).  Note that this function, unlike log_write, can only handle one log type at a time (no bitmasks)
   
SF:    logt > 0        You are not allowed to log_flush() with LOG_SKID_NOXLT  Only one %s output filename allowed     /dev/null       w       Could not assign %s to stdout for writing       a       Failed to open %s output file %s for writing    -%hu    ,       %hu     # Ports scanned: TCP(%d;        ) UDP(%d;       ) PROTOCOLS(%d; )
      <scaninfo type="%s" protocol="%s" numservices="%d" services="   " />
   syn     ack     bounce  connect null    xmas    window  maimon  fin     ipproto ip       vendor="%s"    <address addr="%s" addrtype="mac"%s />
 ipv4    ipv6    <status state="%s" />
<address addr="%s" addrtype="%s" />
      <hostnames><hostname name="%s" type="PTR" /></hostnames>
       <hostnames />
  Host %s not scanned
    Host: %s (%s)	Status: Unknown
  <smurf responses="%d" />
       Host: %s (%s)	Status: Smurf (%d responses)
      Note -- the actual IP also responded.  Host %s seems to be a subnet broadcast address (returned %d extra pings).%s
     Still scanning it due to ping response from its own IP Skipping host   Host %s seems to be a subnet broadcast address (returned %d extra pings). %s.
  Host %s appears to be up.
      Host: %s (%s)	Status: Up
       Host %s appears to be down.
    Host: %s (%s)	Status: Down
     Host %s appears to be up ... good.
     Host %s appears to be down, skipping it.
        osgen="%s"     <osclass type="%s" vendor="%s" osfamily="%s"%s accuracy="%d" />
        %s %s   buffer 0verfl0w of familygenerations    |       Device type:    %s%s     (JUST GUESSING)        
Running%s:      %s      (%d%%)         @Y      ?      ?Unknown MAC Address: %s (%s)
   <os>    <portused state="open" proto="tcp" portid="%hu" />
     <portused state="closed" proto="tcp" portid="%hu" />
   	OS: %s <osmatch name="%s" accuracy="100" line="%d" />
 |%s     OS details: %s  , %s    Aggressive OS guesses: %s (%d%%)        , %s (%d%%)     <osmatch name="%s" accuracy="%d" line="%d"/>
   No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
%s
       No exact OS matches for host (test conditions non-ideal).       
TCP/IP fingerprint:
%s OS Fingerprint:
%s
     No OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
%s
     No OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
%s
     Too many fingerprints match this host to give specific OS details
      TCP/IP fingerprint:
%s  0       <osfingerprint fingerprint="
%s" />
    </os>
  Uptime %.3f days (since %s)
    <uptime seconds="%li" lastboot="%s" />
 STRANGE ERROR #3877 -- please report to fyodor@insecure.org
    %X      <tcpsequence index="%li" class="%s" difficulty="%s" values="%s" />
     	Seq Index: %d  STRANGE ERROR #3876 -- please report to fyodor@insecure.org
    %hX     <ipidsequence class="%s" values="%s" />
        IPID Sequence Generation: %s
   	IPID Seq: %s   <tcptssequence class="%s"        values="%s"     />
    ?      @Y      ?@     Service Info:   %sHost%s: %s    ;       %sOS%s: %s      %sDevice%s: %s  Stats: %d:%02d:%02d elapsed; %d hosts completed (%d up), %d undergoing %s
      @@     WARNING: No targets were specified, so 0 hosts scanned.
        Note: Host seems down. If it is really up, but blocking our ping probes, try -P0
       IP address      IP addresses    host    hosts   Nmap finished: %d %s (%d %s up) scanned in %.3f seconds
                       %s
      <runstats><finished time="%lu" timestr="%s"/><hosts up="%d" down="%d" total="%d" />
    <!-- Nmap run completed at %s; %d %s (%d %s up) scanned in %.3f seconds -->
    # Nmap run completed at %s -- %d %s (%d %s up) scanned in %.3f seconds
 </runstats></nmaprun>
  @@     pspectype2ascii NONE    TCP     UDP     IP Proto        ICMP    ARP     %s: Unknown type: %d            (none)  tcp to port %hu; flags: %s      udp to port %hu protocol %u     Unexpected probespec2ascii type encountered     setIP   Bogus packet passed to %s -- only IPv4 packets allowed  %s:%u: failed assertion `%s'
   scan_engine.cc  iplen >= 20     iplen == (u32) ntohs(ipv4->ip_len)      iplen >= (unsigned) ipv4->ip_hl * 4 + 20        iplen >= (unsigned) ipv4->ip_hl * 4 + 8 tcpseq  Bogus seq number request to %s -- type is %s    sd >= 0 numSDs > 0      0       ?      @@     @I      ?      Unexpected scan type found in scantype_no_response_means()      A      ?      when    probe->timedout @       ?      dnet: Failed to open device %s  socket troubles in UltraScanInfo::Init  foundgood       UltraScanInfo::findIncompleteHost passed a non IPv4 address     host left       hosts left      Completed %s against %s in %.2fs (%d %s)
       %s timed out during %s (%d %s)
 @@     pspec   !probes_outstanding.empty()     num_probes_active > 0   USI->gstats->num_probes_active > 0      num_probes_waiting_retransmit > 0       PING    Ultrascan DROPPED %sprobe packet to %s detected
        Increasing send delay for %s from %d to %d due to %d out of %d dropped probes since last increase.
     A      @       ?ٙ?333333!probe->timedout        !probe->retransmitted   tmng    Unexpected port state: %d
      Changing ping technique for %s to %s
   retry_stack.size() == retry_stack_tries.size()  bench_tryno == probe->tryno     Increased max_successful_tryno for %s to %d (packet drop)
      Increasing send delay for %s from %d to %d due to max_successful_tryno increase to %d
  Socket creation in sendConnectScanProbe Failed to get target socket address in pos_scan Strange error from connect (%d):          WARNING:  eth_send of ARP packet returned %i rather than expected %d (errno=%i: %s)
    USI->scantype != CONNECT_SCAN       sendNextScanProbe: No more probes! Error in Nmap.       !hss->retry_stack.empty()       pspec.type != PS_ARP    Ultrascan PING SENT to %s [%s]
 probe->protocol() == IPPROTO_UDP        hss->num_probes_waiting_retransmit > 0  **TIMING STATS**: IP, probes active/freshportsleft/retry_stack/outstanding/retranwait/onbench, cwnd/ccthresh/delay, timeout/srtt/rttvar/
          Groupstats (%d/%d incomplete): %d/*/*/*/*/* %.2f/%d/* %d/%d/%d
         %s: %d/%d/%d/%d/%d/%d %.2f/%d/%d %li/%d/%d
  A      ?.Hselect failed in do_one_select_round()  probe->type == UltraProbe::UP_CONNECT   Strange SO_ERROR from connection to %s (%d - '%s') -- bailing scan      Strange read error from %s (%d - '%s')  Received -1 response from readarp_reply_pcap    Bad Sequence number from host %s.
      Received scan response with unexpected TCP flags: %d
   Received short ICMP packet (%d bytes)
  o.af() == AF_INET       Unexpected ICMP type/code 3/%d unreachable packet:       or     %ssrc host %s   ran out of space in dst_hosts   tcp     udp     dst host %s and (icmp or (%s and (%s))) dst host %s and (icmp or %s)    ran out of space in pcap filter dst host %s and (icmp or (%s))  dst host %s     mac     arp and ether dst host %02X:%02X:%02X:%02X:%02X:%02X    Pcap filter: %s
        Warning: Giving up on port early because retransmission cap hit.
       probe->tryno == maxtries        processData took %lims
 %d hosts        s       /host   Initiating %s against %s [%d port%s%s] at %02d:%02d
    hosts   ports   The %s took %.2fs to scan %lu total %s.
        host    Finished %s in %.2fs, but %d %s timed out.
     A      ?.H@@     %d,%d,%d,%d,    tm      Initiating TCP ftp bounce scan against %s at %02d:%02d
 PORT %s%i,%i
  Attempting command: %s  send in bounce_scan     Our ftp proxy server hung up on us!  retrying
  Our socket descriptor is dead and we are out of retries. Giving up.
    recv problem from ftp bounce server
    result of port query on port %i: %s     Your ftp bounce server sucks, it won't let us feed bogus ports!
        Your ftp bounce server doesn't allow privileged ports, skipping them.
  And you didn't want to scan any unpriviliged ports.  Giving up.
        LIST
  result of LIST: %s      500     FTP command misalignment detected ... correcting.
      nxt line: %s    Changed my mind about port %i
  Scanned %d ports in %ld seconds via the Bounce scan.
   pos_scan now handles only rpc scan      Starting RPC scan against %s
   Bumping up senddelay by %d (to %d), due to excessive drops
     Bumping up senddelay by 75000 (to %d), due to excessive drops
  rpc     Initiating %s against %s at %02d:%02d
  RPC Scan giving up on port %hu proto %d due to repeated lack of response
       Moving port or prog %lu to the potentially firewalled list
     Timeout, resending to portno/progno %lu
        State mismatch!!@ %d    Sending initial query to port/prog %lu
 Ideal number of queries: %d outstanding: %d max %d ports_left %d timeout %d senddelay: %dus
    WARNING: GAVE UP ON SCAN AFTER 20 RETRIES       The %s took %.2fs to scan %d ports on %s.
      ?ffffff?333333@@     box(%d, %d, %d) called (min,max,num)    vector::reserve Timeout vals: srtt: %d rttvar: %d to: %d        Small negative delta (probably due to libpcap time / gettimeofday() discrepancy) - adjusting from %lius to %dus
        adjust_timeout: packet supposedly had rtt of %lu microseconds.  Ignoring time.  Bogus delta: %ld (srtt %d) ... ignoring
        RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
        delta %ld ==> srtt: %d rttvar: %d to: %d
       Sleeping for %d milliseconds in enforce_scan_delay()
   %s:%u: failed assertion `%s'
   timing.cc       perc_done <= 1.0        ?htj~?      ?ltime   %s Timing: About %.2f%% done; ETC: %02d:%02d (%li:%02li:%02li remaining)
       @Y      box(%d, %d, %d) called (min,max,num)    Character Pool is out of buckets!       nmap-services   Unable to find nmap-services!  Resorting to /etc/services       /etc/services   r       Unable to open %s for reading service information       %127s %hu/%15s  Port %d proto %s is duplicated in services file %s      tcp     udp     ddp     divert  #       Unknown protocol (%s) on line %d of services file %s.   Getfastports: Couldn't get port numbers nmap-protocols  Unable to find nmap-protocols!  Resorting to /etc/protocol      /etc/protocols  r       Unable to open %s for reading protocol information      %127s %hu       Protocol %d is duplicated in protocols file %s  getdefaultprots(): Couldn't get protocol numbers        Getfastprots: Couldn't get protocol numbers     nmap-rpc        Unable to find nmap-rpc!  Resorting to /etc/rpc /etc/rpc        r       Unable to open %s for reading rpc information    	      Unable to find any valid rpc procedures in your rpc file!  RPC scanning won't work for you      Sending RPC probe for program %li to %hu/%s -- scan_offset=%d trynum=%d xid=%lX
        Socket troubles in send_rpc_query       Failed to connect to port %d of %s in send_rpc_query    UDP socket troubles in send_rpc_query   Sendto in send_rpc_query        Write in send_rpc_query Port %hu/%s labelled NON_RPC because of invalid sized message (%d)
     Port %hu/%s labelled NON_RPC because ((scan_offset >> 16) & 0x3FFF) is %li
     Invalid scan_offset returned in RPC packet      Strange -- RPC type is %lu should be RPC_MSG_REPLY (1)  Strange -- auth flavor/opaque_length are %lu/%lu should generally be 0/0        Supposed scan_offset refers to port in state %s (should be testing, closed, or filtered)        Bogus trynum %d when we are only up to %d in get_rpc_results    Lost a packet, decreasing window to %d
 Port %hu/%s claims that it is not RPC service %li       Port %hu/%s claims IT IS RPC service %li        Umm -- RPC returned success for bogus version -- thats OK I guess       Illegal rpc accept_stat ?      Unable to find listening socket in get_rpc_results      recvfrom in get_rpc_results     Received %d byte UDP packet
    Received UDP packet from %d.%d.%d.%d/%hu when expecting packet from %d.%d.%d.%d/%hu
    Failed to read() from tcp rpc socket in get_rpc_results Lamer on port %u closed RPC socket on me in get_rpc_results     Port %hu/%s labelled NON_RPC because tcp_readlen is %d (should be at least 28)
 Port %hu/%s labelled NON_RPC because current_msg_len is %li while tcp_readlen is %d
    Port %hu/%s labelled NON_RPC because current_msg_len is %li
             (      )       %s:%u: failed assertion `%s'
   portlist.cc     sd      serviceprobe_service    tcp     udp     tcpwrapped      rpc.unknownprog %i      %i-%i   rpc #%li        rpc.unknown     state < PORT_HIGHEST_STATE       (owner: %s)            Discovered %s port %hu/%s%s%s
  addPort: attempt to add port number %d with illegal state %d
   protocol!=IPPROTO_IP || portno<256      Duplicate port (%hu/%s)
        Removed %d
     Deleting port %hu/%s, which we thought was %s
   on %s  port_map[proto]!=NULL   afterthisport->proto!=IPPROTO_IP || afterthisport->portno<256   getPortEntry(%i,%i): you're trying to access uninitialized protocol     mapped_pno < port_list_count[proto]     mapped_pno >= 0 WARNING: getPortEntry(%i,%i): this port was not mapped  setPortEntry(%i,%i): you're trying to access uninitialized protocol     WARNING: setPortEntry(%i,%i): this port was not mapped  initializePortMap: portmap for protocol %i already initialized  port_list_count[proto]==0       %s:%u: failed assertion `%s'
   NmapOps.cc      sourcesocklen <= sizeof(*ss)    ss_len > 0 && ss_len <= sizeof(*ss)     NMAP_PRIVILEGED %s/nmap.xsl     /usr/local/share/nmap   root privileges Cannot use both SYN and ACK ping probes if you are nonroot or using IPv6        WARNING:  If -S is being used to fake your source address, you may also have to use -e <interface> and -P0 .  If you are using it to specify your real source address, you can ignore this warning.     WARNING: Many people use -P0 w/Idlescan to prevent pings from their true IP.  On the other hand, timing info Nmap gains from pings can allow for faster, more reliable scans.   WARNING: Your decoys won't be used in the Idlescan portion of your scanning (although all packets sent to the target are spoofed anyway WARNING:  -S will only affect the source address used in a connect() scan if you specify one of your own addresses.  Use -sS or another raw scan if you want to completely spoof your source address, but then you need to know what you're doing to obtain meaningful results. Sorry, UDP Ping (-PU) only works if you are root (because we need to read raw responses off the wire) and only for IPv4 (cause fyodor is too lazy right now to add IPv6 support and nobody has sent a patch)    Sorry, the IPProtoscan, Listscan, and Pingscan (-sO, -sL, -sP) must currently be used alone rather than combined with other scan types. -P0 (skip ping) is incompatable with -sP (ping scan).  If you only want to enumerate hosts, try list scan (-sL) Ping scan is not valid with any other scan types (the other ones all include a ping scan        Warning:  You are not root -- using TCP pingscan rather than ICMP       You requested a scan type which requires %s.  Sorry dude.
      Sorry, but decoys (-D) require %s.
     Sorry, but fragscan requires %s
        TCP/IP fingerprinting (for OS scan) requires %s.  Sorry, dude.
 WARNING:  RPC scan currently does not make use of decoys so don't count on that protection      Hint: if your bounce scan target hosts aren't reachable from here, remember to use -P0 so we don't try and ping them prior to the scan
 You specified more than one type of TCP scan.  Please choose only one of -sA, -b, -sT, -sF, -sI, -sM, -sN, -sS, -sW, and -sX    WARNING: Decoys are irrelevant to the bounce or connect scans   Fragscan only works with TCP, ICMP Timestamp or ICMP Mask (mtu=8) ping types or ACK, FIN, Maimon, NULL, SYN, Window, and XMAS scan types        Combining bounce scan with OS scan seems silly, but I will let you do whatever you want!        Warning: Packet fragmentation selected on a host other than Linux, OpenBSD, FreeBSD, or NetBSD.  This may or may not work.
     WARNING:  OS Scan is unreliable with a ping scan.  You need to use a scan type along with it, such as -sS, -sT, -sF, etc instead of -sP Option --defeat-rst-ratelimit works only with a SYN scan (-sS)  WARNING:  -g is incompatible with the default connect() scan (-sT).  Use a raw scan such as -sS if you want to set the source port.     --min-parallelism must be less than or equal to --max-parallelism       Sorry -- IPv6 support is currently only available for connect() scan (-sT), ping scan (-sP), and list scan (-sL).  OS detection and decoys are also not supported with IPv6.  Further support is under consideration.   NmapOps::setMaxRttTimeout(): maximum round trip time must be greater than 0     NmapOps::setMinRttTimeout(): minimum round trip time must be at least 0 NmapOps::setInitialRttTimeout(): initial round trip time must be greater than 0 NmapOps::setMaxRetransmissions(): must be positive      Minimum host group size may not be set to greater than maximum size (currently %d)
     Maximum host group size may not be set to less than the maximum size (currently %d)
    Max host size must be at least 1        %s:%u: failed assertion `%s'
   TargetGroup.cc  FALSE   Invalid host expression: %s -- colons only allowed in IPv6 addresses, and then you need the -6 switch   /               Illegal netmask value (%d), must be /1 - /32 .  Assuming /32 (one host)
        Warning: Hostname %s resolves to %d IPs. Using %s.      Failed to resolve given hostname/IP: %s.  Note that you can't use '/mask' AND '1-4,7,100-' style IP ranges
     Host specification invalid      Invalid character in  host specification.  Note in particular that square brackets [] are no longer allowed.  They were redundant and can simply be removed.    Invalid target host specification: %s   Your host specifications are illegal!   af == AF_INET6  Invalid host expression: %s -- slash not allowed.  IPv6 addresses can currently only be specified individually  Failed to resolve given IPv6 hostname/IP: %s.  Note that you can't use '/mask' or '[1-4,7,100-]' style ranges for IPv6.  Error code %d: %s
     result->ai_addrlen == sizeof(struct sockaddr_in6)       ipsleft + 1>= hosts_skipped     ss      sslen   Bogus target structure passed to TargetGroup::get_next_host     doing %d.%d.%d.%d = %d.%d.%d.%d
        ipsleft == 1    ipsleft > 1     targets_type == IPV6_ADDRESS    currentaddr.s_addr > startaddr.s_addr   octet != -1     lookahead > 0   Failed to convert target address to presentation format!?!  Error: %s   %s:%u: failed assertion `%s'
   Target.cc       ss      ss_len  targetsocklen <= sizeof(*ss)    ss_len > 0 && ss_len <= sizeof(*ss)     sourcesocklen <= sizeof(*ss)    .-+=:_~*        Illegal character(s) in hostname -- replacing with '*'
 buf     buflen > 8      %s (%s) nexthopsocklen <= sizeof(*next_hop)     directly_connected == 0 || directly_connected == 1      next_hop_len > 0 && next_hop_len <= sizeof(nexthopsock) htn.toclock_running == false    htn.toclock_running == true     ?              Sorry ... ServiceProbeMatch::InitMatch does not yet support reinitializion      ServiceProbeMatch::InitMatch: no matchtext passed in (line %d of nmap-service-probes)   softmatch       match   ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes - must begin with "match" or "softmatch"    ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes: could not find service name        ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes: matchtext must begin with 'm'      ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes: could not find end delimiter for regex     ServiceProbeMatch::InitMatch: illegal regexp option on line %d of nmap-service-probes   ServiceProbeMatch::InitMatch: illegal regexp on line %d of nmap-service-probes (at regexp offset %d): %s
       ServiceProbeMatch::InitMatch: failed to pcre_study regexp on line %d of nmap-service-probes: %s
        ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes: match string must begin with 'm'   ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes     ServiceProbeMatch::InitMatch: Unknown template specifier '%c' on line %d of nmap-service-probes %s:%u: failed assertion `%s'
   service_scan.cc isInitialized   matchtype == SERVICEMATCH_REGEX Warning: Hit PCRE_ERROR_MATCHLIMIT when probing for service %s with the regex '%s'      Unexpected PCRE error (%d) when probing for service %s with the regex '%s'      ,)      offstart >= 0 && offstart < subjectlen  offend >= 0 && offend <= subjectlen     P       SUBST   productlen >= 0 && versionlen >= 0 && infolen >= 0 && hostnamelen >= 0 && ostypelen >= 0 && devicetypelen >= 0          Warning: Servicescan failed to fill product_template (subjectlen: %d). Too long? Match string was line %d: v/%s/%s/%s   Warning: Servicescan failed to fill version_template (subjectlen: %d). Too long? Match string was line %d: v/%s/%s/%s   Warning: Servicescan failed to fill info_template (subjectlen: %d). Too long? Match string was line %d: v/%s/%s/%s      Warning: Servicescan failed to fill hostname_template (subjectlen: %d). Too long? Match string was line %d: h/%s/       Warning: Servicescan failed to fill ostype_template (subjectlen: %d). Too long? Match string was line %d: p/%s/ Warning: Servicescan failed to fill devicetype_template (subjectlen: %d). Too long? Match string was line %d: d/%s/     Parse error on line %d of nmap-service-probes: no arguments found!      TCP     UDP     Parse error on line %d of nmap-service-probes: invalid protocol Parse error on line %d of nmap-service-probes - bad probe name  Parse error on line %d of nmap-service-probes - nothing after probe name        Parse error on line %d of nmap-service-probes - probe string must begin with 'q'        Parse error on line %d of nmap-service-probes -- no ending delimiter for probe string   Parse error on line %d of nmap-service-probes: bad probe string escaping        Parse error on line %d of nmap-service-probes: Ports must be between 0 and 65535 inclusive      Parse error on line %d of nmap-service-probes: An example of proper portlist form is "21-25,53,80"      tunnel == SERVICE_TUNNEL_SSL    ServiceProbe::setRarity: Rarity directive on line %d of nmap-service-probes must be between 1 and 9     r       Failed to open nmap-service-probes file %s for reading  Exclude         Only 1 Exclude directive is allowed in the nmap-service-probes file     Probe   Parse error on line %d of nmap-service-probes file: %s -- line was expected to begin with "Probe " or "Exclude "        !AP->nullProbe  ports   sslports        rarity  fallback        totalwaitms     Error on line %d of nmap-service-probes file (%s): bad totalwaitms value.  Must be between 100 and 300000 milliseconds  The Exclude directive must precede all Probes in nmap-service-probes    Parse error on line %d of nmap-service-probes file: %s -- unknown directive     newProbe        nmap-service-probes     Service scan requested but I cannot find nmap-service-probes file.  It should be in %s, ~/.nmap/ or .   /usr/local/share/nmap   service_scan.h  probeprotocol == IPPROTO_TCP || probeprotocol == IPPROTO_UDP    Bad proto number (%d) specified in AllProbes::isExcluded        ,
	    AllProbes::compileFallbacks: Unknown fallback specified in Probe %s: '%s'       AllProbes::compileFallbacks: MAXFALLBACKS exceeded on probe '%s'        ServiceNFO::addServiceChar - out of space for servicefp 
SF:    resplen probeName       %T=SSL  sparc-sun-solaris2.8    SF-Port%hu-%s:V=%s%s%%I=%d%%D=%d/%d%%Time=%X%%P=%s      4.11    %%r(%s,%X,"     servicefpalloc - servicefplen > 8       \0      \x00    \?"[]().*+$^|   \r      \n      \t      %02x    servicefpalloc - servicefplen > 1       AP->nullProbe   ServiceNFO::nextProbe called for probe in state (%d)    currentresp     Service scan    Discovered open|filtered port %hu/%s on %s is actually open
    probe   probestringlen > 0      Failed to allocate Nsock I/O descriptor in startNextProbe()     svc->tunnel == SERVICE_TUNNEL_SSL       svc->proto == IPPROTO_UDP       ssl/    ssl     A      *member == svc  member != SG->services_remaining.end()  Service scan: Not probing some ports due to low intensity
      Failed to allocate Nsock I/O descriptor in launchSomeServiceProbes()    Starting probes against new service: %s:%hi (%s)
       type == NSE_TYPE_CONNECT || type == NSE_TYPE_CONNECT_SSL        Got nsock CONNECT response with status %s - aborting this service       Unexpected nsock status (%d) returned for connection attempt    Got nsock WRITE error #%d (%s)
 Got nsock WRITE response with status %s - aborting this service A      type == NSE_TYPE_READ   WARNING:  service %s:%hi had allready soft-matched %s, but now soft-matched %s; ignoring second value
  SSL/    Service scan match (Probe %s matched with %s): %s:%hi is %s%s.  Version: |%s|%s|%s|
    soft    hard    Service scan %s match (Probe %s matched with %s): %s:%hi is %s%s
       Unexpected error in NSE_TYPE_READ callback.  Error code: %d (%s)        Unexpected status (%d) in NSE_TYPE_READ callback.       tcp     udp     EXCLUDING %d/%s
        Excluded from version scan      Overriding exclude ports option! Some undesirable ports may be version scanned!
        %u hosts        service services        Initiating service scan against %u %s on %s at %02d:%02d
       service_scan() failed to create new nsock pool. Unexpected nsock_loop error.  Error code %d (%s)        host    hosts   The service scan took %.2fs to scan %u %s on %u %s.
    Finished service scan in %.2fs, but %d %s timed out.
   @@     box(%d, %d, %d) called (min,max,num)    %s:%u: failed assertion `%s'
   NmapOutputTable.cc      numRows > 0     numColumns > 0  cell->str       NmapOutputTable.h       row < numRows   col < numColumns        column < numColumns     cell->str == NULL       NmapOutputTable only supports adding up to 4096 to a cell via addItemFormatString.      nmap-mac-prefixes       Cannot find nmap-mac-prefixes: Ethernet vendor corolation will not be performed r       Unable to open %s.  Ethernet vendor correlation will not be performed   Parse error one line #%d of %s. Giving up parsing.      %s:%u: failed assertion `%s'
   MACLookup.cc    *endptr No space for further MAC prefixes from nmap-mac-prefixes.  Increase MacTable.table_capacity     MACPrefix2Corp called with a NULL prefix        MACCorp2Prefix  %s: vendorstr is NULL   %s: mac_data is NULL    /dev/tty        Verbosity Increased to %d.
     Verbosity Decreased to %d.
     Debugging Increased to %d.
     Debugging Decreased to %d.
     Packet Tracing enabled
.        Packet Tracing disabled
.       Interactive keyboard commands:
?               Display this information
v/V             Increase/decrease verbosity
d/D             Increase/decrease debugging
p/P             Enable/disable packet tracing
anything else   Print status
More help: http://www.insecure.org/nmap/man/man-runtime-interaction.html
    mass_rdns: %.2fs %d/%d [#: %lu, OK: %d, NX: %d, DR: %d, SF: %d, TR: %d]
        @@     CAPACITY <%s> = %d
     %d      mass_rdns: TRANSMITTING for <%s> (server <%s>)
               in-addrarpa         mass_rdns: *DR*OPPING <%s>
     ??ffffffin-addrarpa   mass_dns: warning: got a %s:%s in read_evt_handler()
   mass_rdns: SERVFAIL <id = %d>
  mass_rdns: NXDOMAIN <id = %d>
  mass_rdns: OK MATCHED <%s> to <%s>
     mass_rdns: CNAME found for <%s>
         ,      mass_rdns: Using DNS server %s
 /etc/resolv.conf        r       mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers  nameserver %15s %15s %255s      /etc/hosts                                                                                                                                                                                                                                                                              System DNS resolution   Failed to get target socket address.    mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns_servers     Unable to create nsock pool in nmap_mass_rdns_core()    Performing system-dns for %d domain names that use CNAMEs
      System CNAME DNS resolution     A      DNS resolution of %d IPs took %.2fs. Mode: Async [#: %lu, OK: %d, NX: %d, DR: %d, SF: %d, TR: %d, CN: %d]
      DNS resolution of %d IPs took %.2fs. Mode: System [OK: %d, ??: %d]
     DNS resolution of %d IPs took %.2fs.
   @@     POSIXLY_CORRECT --      %s: option `%s' is ambiguous
   %s: option `--%s' doesn't allow an argument
    %s: option `%c%s' doesn't allow an argument
    %s: option `%s' requires an argument
   %s: unrecognized option `--%s'
 %s: unrecognized option `%c%s'
         %s: illegal option -- %c
       %s: invalid option -- %c
       %s: option requires an argument -- %c
  %s: option `-W %s' is ambiguous
        %s: option `-W %s' doesn't allow an argument
   %s:%u: failed assertion `%s'
   nbase_misc.c    sin->sin_family == AF_INET6     
QUITTING!
     Tried to malloc negative amount of memory!!!    Malloc Failed! Probably out of space.   Tried to realloc negative amount of memory!!!   Realloc Failed! Probably out of space.  /dev/arandom    r       /dev/urandom    /dev/random     Failed to read from /dev/urandom or /dev/random
        Socket troubles %s:%u: failed assertion `%s'
   nsock_connect.c sin->sin_family == AF_INET6     sslen <= sizeof(nse->iod->peer) nsi->state == NSIOD_STATE_INITIAL || nsi->state == NSIOD_STATE_UNKNOWN  nse     TCP connection requested to %s:%hi (IOD #%li) EID %li   SSL/TCP connection requested to %s:%hi (IOD #%li) EID %li       UDP connection requested to %s:%hi (IOD #%li) EID %li   socklen > 0     slen > 0        %s:%u: failed assertion `%s'
   nsock_core.c    msec_timeout >= -1      combined_msecs == -1    Strange connect error from %s (%d)      0       SSL_new failed: %s      SSL_set_fd failed: %s   Uh-oh: SSL_set_session() failed - please tell Fyodor
   bytesleft > 0   res == -1       SSL_read() failed for reason %s on NSI %li      ?ffffff?      Event has unknown type (%d)     nsock_loop() started (timeout=%dms). %d events pending  nsock_loop() started (no timeout). %d events pending    NSOCK (%.4fs)   
       @@     [%s (%d)]       Callback: %s %s %sfor EID %li [%s:%hi]  Callback: %s %s %sfor EID %li (peer unspecified)        :       [EOF]           Callback: %s %s for EID %li [%s:%hi] %s(%d bytes)%s     Callback %s %s for EID %li (peer unspecified) %s(%d bytes)%s    Callback: %s %s %sfor EID %li   %s:%u: failed assertion `%s'
   nsock_iod.c     nsi     nsi_delete() called on nsock_iod which appears to have already been deleted     nsi_delete called with argument NSOCK_PENDING_ERROR on a nsock_iod that has %d pending event(s) associated with it      pending_response == NSOCK_PENDING_NOTIFY || pending_response == NSOCK_PENDING_SILENT    Trying to delete NSI, but could not find %d of the purportedly pending events on that IOD.
     nsi_delete(): SSL shutdown failed (%s) on NSI %li       nsockiod        %s:%u: failed assertion `%s'
   nsock_read.c    nse     Read request for %d lines from IOD #%li [%s:%hi] EID %li        Read request for %d lines from IOD #%li (peer unspecified) EID %li      Read request for %d bytes from IOD #%li [%s:%hi] EID %li        Read request for %d bytes from IOD #%li (peer unspecified) EID %li      Read request from IOD #%li [%s:%hi] (timeout: %dms) EID %li     Read request from IOD #%li (peer unspecified) (timeout: %dms) EID %li   %s:%u: failed assertion `%s'
   nsock_write.c   nse     :       Write request for %d bytes to IOD #%li EID %li [%s:%hi]%s       Write request for %d bytes to IOD #%li EID %li (peer unspecified)%s     ?ffffff?      OpenSSL failed to create a new SSL_CTX: %s      RC4-SHA:RC4-MD5:NULL-SHA:EXP-DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-RC4-MD5:NULL-MD5:EDH-RSA-DES-CBC-SHA:EXP-RC2-CBC-MD5:EDH-RSA-DES-CBC3-SHA:EXP-ADH-RC4-MD5:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EXP-ADH-DES-CBC-SHA:ADH-AES256-SHA:ADH-DES-CBC-SHA:ADH-RC4-MD5:AES256-SHA:DES-CBC-SHA:DES-CBC3-SHA:ADH-DES-CBC3-SHA:AES128-SHA:ADH-AES128-SHA:eNULL:ALL    Unable to set OpenSSL cipher list: %s   %s:%u: failed assertion `%s'
   nsock_event.c   nsp     Event #%li (type %s) cancelled  Bogus event type in nsock_event_cancel  nse->event_done nse     nsp->evl.events_pending >= 0    nse->iod->events_pending >= 0   type <= 3       msiod->state != NSIOD_STATE_DELETED     timeout_msecs >= 0      CONNECT SSL-CONNECT     READ    WRITE   TIMER   UNKNOWN!        NONE    SUCCESS ERROR   TIMEOUT CANCELLED       KILL    EOF     %s:%u: failed assertion `%s'
   nsock_pool.c    res > 7 nsp     nse->iod->events_pending >= 0   setrlimit RLIMIT_NOFILE failed  ?ffffff?      %s:%u: failed assertion `%s'
   gh_list.c       list    list->magic == GH_LIST_MAGIC    list->count == 0 || (list->first && list->last) list->count != 0 || (list->first == NULL && list->last == NULL) free_index < 32 elem    elem->magic == GH_LIST_MAGIC    list->first == elem     list->last == elem      @(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.108.2.6 2005/08/13 23:15:58 guy Exp $ (LBL)       send: %s        %s/%s   /dev    promisc_sap     bufmod  FLUSHR: %s      SBIOCSCHUNKP: %s        SBIOCSTIME: %s  SBIOCSSNAP: %s  BUFMOD_FIXED    WARNING: bufmod is broken in SunOS %s; ignoring snaplen.
       I_PUSH bufmod: %s       DLIOCRAW: %s    unknown mac type %lu    WARNING: DL_PROMISC_SAP failed (%s)
    promisc_phys    promisc_multi   WARNING: DL_PROMISC_MULTI failed (%s)
  A_PROMISCON_REQ: %s     %s: %s  %s: No DLPI device found        %s unit number is negative      %s unit number too large        %s bad unit number      %s missing unit number  attach  /dev/ba ba%u    A_GET_UNITS: %s send_request: putmsg "%s": %s   recv_ack: %s: Ack too small (%d < %d)   recv_ack: %s: Unexpected primitive ack %s       recv_ack: %s: %s        recv_ack: %s: UNIX error - %s   recv_ack: %s getmsg: %s Improper permissions for request        Bad LSAP selector       DLSAP addr in improper format or invalid        Primitive issued in improper state      UNIX system error occurred      Seq number not from outstand DL_CONN_IND        User data exceeded provider limit       Requested service not supplied by provider      Specified PPA (device unit) was invalid Primitive received not known by provider        QOS parameters contained invalid values QOS structure type is unknown/unsupported       Token used not an active stream Attempted second bind with dl_max_conind        Physical link initialization failed     Provider couldn't allocate alternate address    Physical link not initialized   Previous data unit could not be delivered       Primitive is known but not supported    Limit exceeded  Promiscuous mode not enabled    Other streams for PPA in post-attached  Automatic handling XID&TEST not supported       Automatic handling of XID not supported Automatic handling of TEST not supported        Automatic handling of XID response      Automatic handling of TEST response     Pending outstanding connect indications Error %02x      DL_INFO_REQ     DL_BIND_REQ     DL_UNBIND_REQ   DL_INFO_ACK     DL_BIND_ACK     DL_ERROR_ACK    DL_OK_ACK       DL_UNITDATA_REQ DL_UNITDATA_IND DL_UDERROR_IND  DL_UDQOS_REQ    DL_ATTACH_REQ   DL_DETACH_REQ   DL_CONNECT_REQ  DL_CONNECT_IND  DL_CONNECT_RES  DL_CONNECT_CON  DL_TOKEN_REQ    DL_TOKEN_ACK    DL_DISCONNECT_REQ       DL_DISCONNECT_IND       unknown primitive 0x%x  DL_RESET_REQ    DL_RESET_IND    DL_RESET_RES    DL_RESET_CON    DL_SUBS_BIND_REQ        DL_SUBS_BIND_ACK        bind    promiscon       info    ?       @(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.88.2.8 2005/08/13 22:29:46 hannes Exp $ (LBL)  malloc: %s      DLT %d is not one of the DLTs supported by this device  %s is not one of the DLTs supported by this device      DLT_NULL        BSD loopback    DLT_EN10MB      Ethernet        DLT_IEEE802     Token ring      DLT_ARCNET      ARCNET  DLT_SLIP        SLIP    DLT_PPP PPP     DLT_FDDI        FDDI    DLT_ATM_RFC1483 RFC 1483 LLC-encapsulated ATM   DLT_RAW Raw IP  DLT_SLIP_BSDOS  BSD/OS SLIP     DLT_PPP_BSDOS   BSD/OS PPP      DLT_ATM_CLIP    Linux Classical IP-over-ATM     DLT_PPP_SERIAL  PPP over serial DLT_PPP_ETHER   PPPoE   DLT_C_HDLC      Cisco HDLC      DLT_IEEE802_11  802.11  DLT_FRELAY      Frame Relay     DLT_LOOP        OpenBSD loopback        DLT_ENC OpenBSD encapsulated IP DLT_LINUX_SLL   Linux cooked    DLT_LTALK       Localtalk       DLT_PFLOG       OpenBSD pflog file      DLT_PRISM_HEADER        802.11 plus Prism header        DLT_IP_OVER_FC  RFC 2625 IP-over-Fibre Channel  DLT_SUNATM      Sun raw ATM     DLT_IEEE802_11_RADIO    802.11 plus BSD radio information header        DLT_APPLE_IP_OVER_IEEE1394      Apple IP-over-IEEE 1394 DLT_ARCNET_LINUX        Linux ARCNET    DLT_DOCSIS      DOCSIS  DLT_LINUX_IRDA  Linux IrDA      DLT_IEEE802_11_RADIO_AVS        802.11 plus AVS radio information header        DLT_SYMANTEC_FIREWALL   Symantec Firewall       DLT_JUNIPER_ATM1        Juniper ATM1 PIC        DLT_JUNIPER_ATM2        Juniper ATM2 PIC        DLT_JUNIPER_MLPPP       Juniper Multi-Link PPP  DLT_PPP_PPPD    PPP for pppd, with direction flag       DLT_JUNIPER_PPPOE       Juniper PPPoE   DLT_JUNIPER_PPPOE_ATM   Juniper PPPoE/ATM       DLT_GPRS_LLC    GPRS LLC        DLT_GPF_T       GPF-T   DLT_GPF_F       GPF-F   DLT_JUNIPER_PIC_PEER    Juniper PIC Peer        DLT_JUNIPER_MLFR        Juniper Multi-Link Frame Relay  DLT_ERF_ETH     Ethernet with Endace ERF header DLT_ERF_POS     Packet-over-SONET with Endace ERF header        DLT_JUNIPER_GGSN        Juniper GGSN PIC        DLT_JUNIPER_ES  Juniper Encryption Services PIC DLT_JUNIPER_MONITOR     Juniper Passive Monitor PIC     DLT_JUNIPER_SERVICES    Juniper Advanced Services PIC   DLT_JUNIPER_MFR Juniper FRF.16 Frame Relay      DLT_JUNIPER_ETHER       Juniper Ethernet        DLT_JUNIPER_PPP Juniper PPP     DLT_JUNIPER_FRELAY      Juniper Frame Relay     DLT_JUNIPER_CHDLC       Juniper C-HDLC   	
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~%s: %s
 F_GETFL: %s     F_SETFL: %s     Setting direction is not implemented on this platform   Statistics aren't available from a pcap_open_dead pcap_t        libpcap version 0.9.4   @(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.66.2.1 2005/06/20 21:30:17 guy Exp $ (LBL)     any     malloc: %s      no suitable device found        inet class for 0x%x unknown     SIOCGIFNETMASK: %s: %s  SIOCGIFADDR: %s: %s     %s: no IPv4 address assigned    socket: %s      @(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.34 2005/09/05 09:08:04 guy Exp $ (LBL)        out of memory           syntax error in filter expression       expression rejects all packets  snaplen of 0 rejects all packets        unknown data link type %d       unsupported protocol over mpls  DOCSIS link-layer type filtering not implemented        IrDA link-layer type filtering not implemented  LAPD link-layer type filtering not implemented  ISO host filtering not implemented      'sctp' modifier applied to host 'tcp' modifier applied to host  'udp' modifier applied to host  'icmp' modifier applied to host 'igmp' modifier applied to host 'igrp' modifier applied to host ATALK host filtering not implemented    LAT host filtering not implemented      SCA host filtering not implemented      MOPRC host filtering not implemented    MOPDL host filtering not implemented    'ah' modifier applied to host   'esp' modifier applied to host  'pim' modifier applied to host  'vrrp' modifier applied to host AARP host filtering not implemented     'esis' modifier applied to host 'isis' modifier applied to host 'clnp' modifier applied to host 'stp' modifier applied to host  IPX host filtering not implemented      'netbeui' modifier applied to host      'radio' modifier applied to host        direction applied to 'gateway'  illegal modifier of 'gateway'   'gateway' supported only on ethernet/FDDI/token ring/802.11/Fibre Channel       link layer applied in wrong context     'radio' is not a valid protocol type    unknown ip proto '%s'   unknown ether proto '%s'        esis    isis    clnp    unknown osi proto '%s'  bad protocol applied for 'protochain'   'protochain' not supported with radiotap headers        unsupported proto to gen_protochain     direction applied to 'proto'    arp does not encapsulate another protocol       rarp does not encapsulate another protocol      'sctp proto' is bogus   'tcp proto' is bogus    'udp proto' is bogus    'icmp proto' is bogus   'igmp proto' is bogus   'igrp proto' is bogus   atalk encapsulation is not specifiable  decnet encapsulation is not specifiable lat does not encapsulate another protocol       sca does not encapsulate another protocol       moprc does not encapsulate another protocol     mopdl does not encapsulate another protocol     'ah proto' is bogus     'pim proto' is bogus    'vrrp proto' is bogus   'stp proto' is bogus    'ipx proto' is bogus    'netbeui proto' is bogus        'radio proto' is bogus  unknown host '%s'       only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name       unknown ether host '%s' unknown 802.11 host '%s'        unknown FDDI host '%s'  unknown token ring host '%s'    unknown Fibre Channel host '%s' illegal qualifier of 'port'     port '%s' is tcp        port '%s' is udp        port '%s' is sctp       unknown port '%s'       unknown network '%s'    illegal qualifier of 'portrange'        port in range '%s' is tcp       port in range '%s' is udp       port in range '%s' is sctp      unknown port in range '%s'      unknown protocol: %s    unknown ether host: %s  Mask syntax for networks only   non-network bits set in "%s mask %s"    mask length must be <= 32       non-network bits set in "%s/%d" 'gateway' requires a name       illegal link layer address      ethernet address used in non-ether expression   ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel     data size must be 1, 2, or 4    unsupported index operation     radio information not present in capture        too many registers needed to evaluate expression        only link-layer/IP broadcast filters supported  not a broadcast link    link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel    inbound/outbound not supported on linktype %d   ifname not supported on linktype 0x%x   ifname interface names can only be %d characters        ruleset not supported on linktype 0x%x  ruleset names can only be %ld characters        rnr not supported on linktype 0x%x      srnr not supported on linktype 0x%x     reason not supported on linktype 0x%x   action not supported on linktype 0x%x   ARCnet address used in non-arc expression       no VLAN match after MPLS        no VLAN support for data link type %d   no MPLS support for data link type %d   'vpi' supported only on raw ATM 'vci' supported only on raw ATM 'callref' supported only on raw ATM     'metac' supported only on raw ATM       'bcc' supported only on raw ATM 'oam4sc' supported only on raw ATM      'oam4ec' supported only on raw ATM      'sc' supported only on raw ATM  'ilmic' supported only on raw ATM       'lane' supported only on raw ATM        'llc' supported only on raw ATM 'sio' supported only on SS7     sio value %u too big; max value = 255   sls value %u too big; max value = 15    'sls' supported only on SS7     'dpc' supported only on SS7     dpc value %u too big; max value = 16383 'opc' supported only on SS7     opc value %u too big; max value = 16383 'oam' supported only on raw ATM 'metaconnect' supported only on raw ATM 'connectmsg' supported only on raw ATM  'oamf4' supported only on raw ATM       @(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.85 2005/04/04 08:42:18 guy Exp $ (LBL)     division by zero        malloc  %s for block-local relative jump: off=%d        multiple matches        no destination found    no jmp destination      not enough core malloc: %s      @(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.77.2.3 2005/04/20 11:13:51 guy Exp $ (LBL)       tcp     udp     %d-%d   pup     xns     ip      arp     rarp    sprite  mopdl   moprc   decnet  lat     sca     lanbridge       vexp    vprod   atalk   atalkarp        loopback        decdts  decdns  iso     stp     ipx     netbeui %d.%d   malformed decnet address '%s'   decnet name support not included, '%s' cannot be translated
    @(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.126.2.13 2005/08/29 21:05:45 guy Exp $ (LBL)       Statistics aren't available from savefiles      Sending packets isn't supported on savefiles    Setting direction is not supported on savefiles r       %s: %s  bad dump file format    out of swap     archaic file format     error reading dump file: %s     truncated dump file; tried to read %lu file header bytes, only got %lu  truncated dump file; tried to read %d header bytes, only got %lu        truncated dump file; tried to read %u captured bytes, only got %lu      BUFMOD hack malloc      bogus savefile header   Can't write to %s: %s   w       standard output %s: link-layer type %d isn't supported in savefiles     stream  stream: link-layer type %d isn't supported in savefiles @(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.44 2003/11/15 23:24:07 guy Exp $ (LBL)            [ [ [ \  \ \ \  d d \ \ \ \                        \  _ c 9    d      g a ^ ` ] b                                ! "              Q  :            K               : c e e d    g d g g g   9   F       Y               #    *       <   D $      - ; G X          S     W  Z %   )  	 
 N  M     d      h g g   g   g   g       6 (  &       ,         C  4  .    @     /   '    R   T     ?  e e e d   g     g   g h g         g g g g g                 L     E     H    1                   g g g     h g g h g     g g g g g         g g   g   g   V                 <        A B  U           e e e   g g   g     g   g h g       g g   g h g               g g g g g     3 5             =   + I J      {  } |        g g g g g g     h g g g     g g g g g               g g g g g           g g   g   g               j i   >    ~ z e   g g   g g   g     g   g h g       g g   g h g           g g   g h g   g g               g g g g g   7  o v          8 0       g g g g g g g g g     h g g g     g g g g g               g g g g g   g g               g g g g g             g g   g   g   O            2   g g   g g   g g   g   f g   g h g       g g   g h g           g g   g h g             g g   g h g   g g g               g g g g g           t  P     g g g g g g g g g g g g   f h g g g     g g g g g               g g g g g   g g               g g g g g   g g g               g g g g g             g g   g   g      x        l   g g   g g   g g   g g   g       g     g h g       g g   g h g           g g   g h g             g g   g h g             g g   g h g   g g g               g g g g g       n    r      g g g g g g g g g g g g g g g       h     g     g g g               g g g   g g               g g g   g g g               g g g   g g g               g g g             g g   g   g   k w y s         g   g   g g   g g   g g   g g   g         g g   g     g g g         g g g           g g g           g g g           g g g g g g               g g g             g g g g g g         g g         g g g           g g g g           g g g g           g g g g           g           g g g    u g g g g g g g g         g g     g       g       g       g       g g g g           g p  m g     g g   g g g   g g g   g g g   g g g         g q g g             g g g     g g g g g   g g                                                                                                                                    	   	      
      	                                                                                                                                                                      !   "   #   $      %   &   '   (   )   *   +   ,   -   .   /   0   1   2   3         4                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     	                                                                              	            e 4 5O ;Z ? P 1  7C >    j $   77 n+    e     }"       
+   A1  X (        d &1          ~ }Fz.p|Z  X\bYPQz `Z` X=B    ?i?&       k               S      |x  v  v  u      r  \    _  \]*rpon2=<Zp    $',    )  (  	                


  






  
  
       

    




  

I


  


~  

2  

t
  
}  
`
Y    
c
Q
P
a
^  
S
>
L
E
L
E
8
9
2
$
3V
<
;m
:
8
7
6
!
 P

%
  p
    
	  											  							    	  										(		O	e			{5<    q	  W	6			n	s    	u	w	i	[	g	U	S	K	A	B	L	J  	"	      	)	!		
    	      	 *		A1iUV=DY!X_.    7M      _  lgZ      uczts &  ,  i3J  P  V  xh\cy  ZPYRQV)>iOLKA"+J*)'%r$K7# L9)@a;	<gf		/=  	  	  	E	W	m	L  jPN	)
u5							


/
5
K
R
h
  
  



  
  
  


        E4K    Q3X_]fm6	U	V^|Nlwk+z;:9Ri{&"G	 B	SI&k  W	}G Ne=C  <  B  u{  h/FMcz    v     #  )0G    M  S  Y`w    }    p    $qQO&34r9	+%*
Mhu  J<C|od\kPV"!2I  2OV]der  4x{      _    ]s	I  F;  R  *i  1    8&!	  r    pc      `;      l:9  
      b+%3M:  dE            z    t  yvu    sr    MI    >        	  		+,                    #    /    5    ;    AHI V  -	q  \  b    h   o   ^u   _{ _    r` ^            b A                  !$'*-037;?DHKNRTWZ]`cgilosux} #&)-/25:>CGKOTX[^adgjmquy}
"%(,.147<@EIMQVZ]`cfilorvz~!%(,/268;>BDGJMQSVY\`behkoqtw|	 #&*,158;>ADGKPSVY\_behknqvz}  ) ))))))*))))) ))))  +                    ))),)   - 2  ))))))++ 2 ?     ?      ?     ?                                                       ))   2 .) 6) /                                                                                  0 12) 34))) 5                                                     '  6)78))))19:;))8):<5                                         1=)i>)?@)o3AB))u)wC9))DE))))F                                        fG)1)3HI))))J)KL))))MN)D)O)))PF                                  QR)S)T)UV)WX)))YJZ)K)[)))\M)])^_))))`                      a)))9))<bc))))Cd)ef))))Lg)h)ij))))Wkl)]m)n)o))d)fpqrrrrrrrrrrrrrrrrrst)}u)v)w)xy)z{)))|}~)))))))))))))))))))))))))))))))))))))))))))))))))))))))!)))')),).))))8):)))))G)I)))))W)Y))))))e)))w))z))}))))))))))))))))))))))))))))))))))))))))))) )))))))	
)))))))))) ))))),        )8!")#<)$?)%B)&E)'H())M)*+,)-.)/)0)12)34)5)67)89):);<)=>)?)@A)BCD)EF)G)H))IJKKKK)LMNOPQR)ST)UVW)X)YZ)[\)])^_`)ab)c)def)gh)i)jkl)mn)o)pq)r)st)uvvvvw)xyz{|}~)))))))))))))q)r)s)vvv))))))))v))  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))        	 
                                 ! " # $  % & ' ( ) *   + , ,  , , , , , , , , , , E , , , , , , 5 8 9 , , , F , ; < 5 ,  G  , 0 1 2 2 2 2 2 2 3 5 N O 4 5 6 0 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 6 5 , h ? , @ , Q  , A i   B 5 = 7 C = D = R  = , 5 4 4 4 4 4 4 = K H c  I 5 d = J  L j y M  e f 5 z[ { g | k\ l } m ~  n 5 5 5 5 5 5 5)  \ ] 5 5   5 5 5 5 5 5 T ^  U V _ W 5 X ` Y a Z t o [ 5 u b p q  r s  v   w , x  ,  , 5  ,       ) , 5       , 1       #)  -r)             = 0$ =  =)  =        , = 0 ,  , 0p , =        ,j   h 0  ,       5        5        5       0b`ZX         '((((( 677777)999999 5sttttt| 0S        })  0 5 0             ) 0 }) 0q               0^ ) _F      G`)abcH  5      +')I)vvvvvv|777777% ))))))q)I) 5):)))))) 1****** 01111112) 5)3)4qFq333333)tttttt)4 888888 ))9)C 0 0q999999:;;;;;@ 0 0<))=)<<<<<<e((((((f))GP 0RfijjjjjHQkS 0 0qkkkkkkopppppq 0)rHQSrrrrrr0uuuuuu2)B=v) 0 0vvvvvvwxxxxxqK 0 0y) 0yyyyyy ~~~~~~ q) 0)) 0 0q))q)))))V)) 0) 0))f04x	




 0q 04 0 0{) 0 00q]) 0 0 0 0])  0 0q) 0 0 0 0~ 0 0)[\\\\\)G)JJJJJJ 0 0q) 0 0 0 0n 0)qq) 0 )) 0 0       0) 0)r))q))) 0q 0)) 0)tqP 0I) 0 0F 0 0) 0C 0d3@=)fP





0 0666666$)d6) 0 0-666666999999: 0$;)`);;;;;;R)UUUUUU 0<<<<<<=^>)q 0=>>>>>>^_____bccccc 0)BCCCCCCDEqF 0@CEEEEEE)eeeeee) 0 0FIIIIII:~)qJ)) 0 0{JJJJJJKLLLLLLMqmN)Ox))NNNNNN) 0qOTTTTTT=qU_ 0o 0UUUUUUVWWWWWWXp 0YZ6_YYYYYY)^ 0 0Zddddddg_oe 0 0eeeeeefgggggi)hg_o 0`hhhhhh}~~~~~a 0) 0 0F: 0 0a 0 0 0 00 0= 01 0 0 0 0 0 02 0q4 0 0 0IBD 0 0q+-KM 0 0 0q 0 0 0&)VX & 0 0~{q 0 0x v&)\\\\\\______aaaaaaccccccf) 0 0& 0 0 0 0V 0 0!BRPFqK)GBFKO|OV|Z)=:Z||zyxw 0 0Bvutsr 0 0qsponml) 0kKjX 0MDA=:      0 08V5 04 03210/.) 0 0-,+* 0 0)jkl(	'&%						$#"! |B 0 0e)K 0  0       )V!""""" #q0q######)'(((((qnh)h))))))*+++++,,,,,,-------./////q0000000)------233333677777888888 k9999999:;;;;;q <qnhh<<<<<<)999999>?????ABBBBBEFFFFFGGGGGG) dH]ZYXWHHHHHHIJJJJJqVUTKSRQPOKKKKKK)HHHHHHNOOOOOQRRRRRUVVVVVWWWWWWNMLXKJEDXXXXXXYZZZZZqCBA[@?>2 [[[[[[)XXXXXX^      `bbbbbb/  c, &%"cccccc)ccccccdeeeeeef! ghgggggg++++++)hwwwwwwxyyyyyyy333333B555555zzzzzz{|
	||||||777777)}}}}}}~??????BBBBBB         KDDDDDDFFFFFF %   &  1       & )OOOOOO'  x (         (   RRRRRRVTTTTTT  {               VVVVVV)  ~                SS P : /T -))))))))T))))X))df)Y)))))) 0 0 0 0 0Y 0)) 0 0 0 0 0) 0) 0))))Z 05))[)7)))),,,,,,x)))-[))))------))))))))))------888888{)))9)))))999999))))))))))999999GGGGGG~)))H)))))HHHHHH))))))))))HHHHHHWWWWWW)))X)))))XXXXXX))))))))))XXXXXX)))))))))))))))))))))))))))))))))))))	




)))))))))      )))!)))))!!!!!!)!!!!!!%'d))))))f)))*)))))******)******+,,,,,,-))).)/)))......KLLLLL)NNNNNN))`/899999:)));a))));;;;;;<<<<<<=)))>))a)>>>>>>S)VVVVVV))??????@)))A))))AAAAAAX))BBBBBBC)))D))))DDDDDDZ)]]]]]]b)EEEEEEF))cG))))GGGGGG`c))HHHHHHI)))J))))JJJJJJbh)MMMMMM))iN)))))NNNNNNUUUUUU=)))V)i)))VVVVVV\\\\\\@)))])))))]]]]]]ddddddC)))e)))))eeeeee)eeeeee





hjj)))))k)mmmmmmp)pr))kllllllFqs)m)))))mmmmmm))))qsrttttttI)))u)))))uuuuuu)uuuuuuxyyyyy{|||||+-)))) 0 0))) 0 0))))))))))))))=)))))))@)))))))C))))))))F)))))))))      I)))!)))))!!!!!!)!!!!!!LLLLLL)))))))))yyyyyy||||||))))d~~~~~~)))))NNNNNN+-))))))))MMMMMM)))N))))NNNNNN))))))))))))))))))))) )))))					)))))+						 .)))) . . . >) > > > > > > > )          +++---...555333=)=ggglllmmmz)z{{{77))7tt))t)))))))))777;;;>>>???@@@EEE))NNN

))
))YYY])]`)`aaai)i{{{))))))\))\__))_``)`cc))cii)i 5 5 5) 5 5???)))))))))))))))))))))
)
 5 5 5) 5 5$$$%%%1)14)4555=)=@)@C)CDDDL)LM)MP)PS)STTT\)\))))  )) )))ggg

)
 5 5 5) 5 5uuuyyy|||++))+11)133))344)477))7==)=?))?@@)@BB))BCC)CFF))FLL)LM)MO))OPP)PRR))RSS)SVV))V\\)\)))) 5 5 5) 5 5)))) ) ))))))))"""#)#)))))))))...) 5 5 5) 5 5>>>AAADDDGGGJJJOOOQ)QRRR))WWW))))))^^^))))))  ) ))fff))
))
))))))nnn))))))))))vvv##)#w)wz)z})}~~~)) 5 5 5) 5 5))))))LL))L555QQ)Q))))))))))))w)wy))yzz)z||))|}})})))) 5 5 5) 5 5))))))))))))))))))))))))))))))))))))))))))))))) 5 5 5) 5 5)))))))))))))))))
)
)))))))))))))))	))	))))))!)!")"#)#$)$%)%))')'()( ))))))))))))))))))))))))))))))))))))))))))))))))))))                                                         Z     	   	  	   	        	       @ 	 @  Z                                           "      V   "  V
          '             ! '   !   _  # &  _ ! !  & & ! & # # & # & & #         ^       ^ E          K      E        % $  K %   $ $ ) $ $ P % y ) % , % ) , ) , P N , 1 1 1 1 1 1 y  , 4 4 4 4 4 4 4 , 2 2 2 2 2 2 2 N   2 N  2 2 2 2 2 2 6 6 6 6 6 6 =j  = 6 =  t = [ 6 6 6 6 6 6 7 =j 7 t 7r 7 = } 7 7 7 7 7 7 7 [ } 7r [ 7r 7 7 7 7 7 7 ? ? ? ? ? ? ? {         {       ~ ~ ?                           (0000006sTW        6;T Ws(ws             jw 6;u              uu# j #      #p###eeeeees        }sp33333337777777z       sIv uxI                      x  nmf      9999999ttttttt          ex^            ]Tx T      '''''''||||||'vvvvvvv	',,,,,,	,kW,,,,,,///////k[/	k//////11111111gV1[qv1111112222222qv2gvq22222288888888R~8Q888888::::::::P:~:O:::::::FF;F^FbFFFFffffff^bf*ffffffiiiiiiiib^ibi#biiiiii"liooooooooooloooooolmouuuuuuuuulmuuuuuuwwwwwwwwlmwwwwwwwwnpwnpnp yyy"(o/oo"(;>J/NZ;>tJtNZrsrsrs))






qUqUq\d\d;;;;;;;>>>>>>>BBBBBBucEEEEEEEGGGGGG	\[S9P	0888888Ll08x91l88888899999999192x*999999::::::*2:K::::::<<<<<<<<*<34<<<<<<======34=C4@=======AAAAAAAtAtAAAAAACCCCCCCCC<41CCCCCCDDDDDDDD DDDDDDKKKKKKLLLLLLLL L0)LLLLLLMMMMMMMM%$#MMMMMMNNNNNNNPPPPPPRRRRRRVVVVVVWWWWWWWWW WWWWWWXXXXXXXXXXXXXXYYYYYYY\\\\\\_______aaaaaaacccccccdddddddd
	dddddddeeeeeeeffffffffotfzf2ffffffot2zotfz}}}}}}}}}2}}}}}}}}6|{6ih`]6UJ@?7321/.+*)('&%$#"n! n nAAAEEEQQQ555{zyrqnmlkhgdcba`_^]\[ZXVUSRONLJIHEDBA@>=<5.-+*)$"                                 +++++++-------         33333335555555         77777779999999U   U    ??????BBBBBBBU  !!!!!!!!   ! !   !!!!!!DDDDDDDFFFFFFF !&&&&&&&   &    &&&&&&''''''''   ' '  ''''''HHHHHHHOOOOOO  ~',,,,,,,, | z, x w v u s,,,,,,........ r q p.. o n l......RRRRRRRTTTTTTT j i.88888888 h g f8 e d c b a888888:::::::: ` Y X: W: U T S::::::VVVVVVVXXXXXXX R Q:GGGGGGGG O M LG J I H G FGGGGGGIIIIIIII D C BI 3I + * (IIIIII^^^^^^``````   IWWWWWWWW 
 W         WWWWWWYYYYYYYY      YY      YYYYYYddddddggggggg    Yeeeeeeee    e          eeeeeeffffffijkmfp    ffffffijkm  p        ijk  mpvvvvvv      v        vvvvvvwwwwwwww      w        wwwwwwxxxxxx        x          xxxxxxyyyyyyyzzzzzzzz      z          zzzzzz{{{{{{        {          {{{{{{|||||||}}}}}}}}      }          }}}}}}~~~~~~        ~          ~~~~~~                                                                                                                                                                                                                                                                                                                                    





                                                                   !!!!!!!%%%%%%''''''++++++,,,,,,,,      ,  67    ,,,,,,.......67>>>>>>>      7688888888      8  8      888888AAAAAAADDDDDDDK  8<<<<<<<<    K<          <<<<<<????????      ?  K      ??????BBBBBBBB      B          BBBBBBEEEEEEEE      E          EEEEEEGGGGGGGHHHHHHHH      H          HHHHHHJJJJJJJLLLLLLLMMMMMMMM      M          MMMMMMNNNNNNNSSSSSSXXXXXXZZZZZZ``````bbbbbbhhhhhhjjjjjjpppppprrrrrryyyyyy{|||||||        {~~~~~~~      {                                                                                            						*        ***+  +++++++,  ,---...///0001112223334445  56667778889  9:::;;    ;<<<===>>>???@@@AAABB    BCCCD  DEEEF  FGGGHHHIIIJ  JK  KLLLM  MNN    NOO    OPPPQQQRRRSSSTTTUUUVVVWWWXX    XYYYZZ    Z[[    [\\\]  ]^  ^___`  `aaabbbcccd  de  efffg  gh  hi  ijjjk  kl    lmm    mnn  noo    opppqq  qrrr  rrssstttuuuvvvwwwxxxyyyzzz{{    {|||}}  }~~    ~                                                                                                                                                                                                                                         		  	
  
                                                       !  !"""#  #$  $%  %&  &'  '((    ()))***++  +,,,-  -...///0  01  12223334  45  56  67778889  9:  :;  ;<<<===>  >?  ?@  @AAABBBC  CD    DEE  EFF    FGG  GHH    HI  IJJ  JKKK  KKLLLM  MN  NO  OP  PQ  QR  RS  STTTUUUV  VWW    WXX  XY  YZ    Z[[  [\\    \]]  ]^  ^_  _`    `aa  abb    bcc  cd  de  ef    fgg  ghh    hii  ij  jk  kl    lmm  mnn    noo  op  pq  qr  rs  stttu  uvvv  vvw  wx  xy  yz  z{  {|  |}  }~~    ~                                                                                  )))))))))))))))))))))))))))))))))))))))))))))))))))))@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.99.2.4 2005/09/05 09:08:07 guy Exp $ (LBL)  %s not supported        IPv6 address %s not supported   bogus ethernet address %s       illegal token: %s       illegal char '%c'       fatal flex scanner internal error--no action found      input in flex scanner failed    fatal error - scanner input buffer overflow     fatal flex scanner internal error--end of buffer missed flex scanner push-back overflow out of dynamic memory in pcap__create_buffer()  out of dynamic memory in pcap__scan_buffer()    out of dynamic memory in pcap__scan_bytes()     bad buffer in pcap__scan_bytes()        %s
     @(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.86.2.5 2005/09/05 09:08:06 guy Exp $ (LBL)  %s       dfmlighjsponqre	
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abck     tuuvwwwwwxyzzz{{{{{{{{{|}~~~      2   @A?BCDEFGHIJKLMNPOij      >QRSTlnopUV_WXYZ[\^]`abc 22  1,q -.  fg rstuxyvzw km  
22  '  439=:;<$%de"#& |~        {}     /   0   22	(        ! *+  h  8675       x u v    p   S T U V    q X Y j l   Z [  \ ] ^ _    `   O  OOOOOOOOOOOOOOOOOOOOOO 
     OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO, OOOOOO  OOOOOOOOOOOOOOOO##OOO OOOOOOOOOOOOO 7OOOOOOOOO 2 ? FOOO H ^ iOOOOOOO p cO##O OOOOO j z {OO :    O ; ) )O OO c cOOOOOOOOOOOOOOOO O 2O HOO >OOOOOO P OOOOOO &O OOOO , <OOOOOdOOOoO R   w n o Q  W  h  y  { | } ~  t  a  i  s t b  s t c   f  m m t    y    z   g     r d    e    M       k  O  z R R       Q Q W W     O        m  w       y       W W   m                                                P       R            W W                        	 
                          ! " O        O    # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L     M       N       O    	 
                            ! "       { | } ~      # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L   M       N       O    	 
                            ! "                # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L     M       N         O   	 
                                 "                   # $ % & '         , - . / 0 1 2 3 4 5 6 7 8 9                    H               N      O    T   $   Q ( )     $  R   1 2 3 4 5 c $ $  1  b c $ l b c $ u v $ l ( ) c u v  p e f  R l T b c $ n o p l N 1  l  1 	 
  d b c 6 7 b c 1 m m q p Q R l T u v  $ Q R Q R j p _ ` m    $ b c b c i j $ m $  l j l 6 7 u v q  g h i j u v u v    $         _ ` $   g h i j $     6 7 _ ` 3 $ $ e f g h i j l   $   $ r s $ r   . / 0    . / 0         e f g h i j                      !   $ % & ' ( ) * + , - m n o p m n o p 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a d h   m                    ! $ % & ' ( ) * + , - 1 2 3 4 5 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a 6 7 d h   m                    ! $ % & ' ( ) * + , - f g h i j 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a d h m                   ! $ . / 0 - 6 7 8 9 : ; < A B C D E F G H I J K L M N      	 
   ] e f g h i j h n o p m " #   uv  !$%&'()*+,-89:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`adhmw|}$$$11$$$11}}bcxyw12345z{|}	
"#q./067efghijnop$}$}efnopz|}zllljjz{~bcbc$$$$$3$$lxyrslylyzz$r      'ip6addr/prefixlen' not supported in this configuration 'ip6addr' not supported in this configuration   match   bad-offset      fragment        short   normalize       memory  unknown PF reason       pass    accept  drop    block   unknown PF action       syntax error    parser stack overflow   @(#) $Header: /tcpdump/master/libpcap/fad-glifc.c,v 1.5.2.1 2005/04/19 00:54:16 guy Exp $ (LBL) dummy   SIOCGLIFDSTADDR: %.*s: %s       SIOCGLIFBRDADDR: %.*s: %s       SIOCGLIFNETMASK: %.*s: %s       SIOCGLIFFLAGS: %.*s: %s SIOCGLIFCONF: %s        malloc: %s      SIOCGLIFNUM: %s socket: %s        /%d     /dev/ip /dev/%s 0123456789      /dev/ip 0       1       2       3       4       5       6       7       8       9       10      11      12      13      14      15      16      17      18      19      20      21      22      23      24      25      26      27      28      29      30      31      32      33      34      35      36      37      38      39      40      41      42      43      44      45      46      47      48      49      50      51      52      53      54      55      56      57      58      59      60      61      62      63      64      65      66      67      68      69      70      71      72      73      74      75      76      77      78      79      80      81      82      83      84      85      86      87      88      89      90      91      92      93      94      95      96      97      98      99      100     101     102     103     104     105     106     107     108     109     110     111     112     113     114     115     116     117     118     119     120     121     122     123     124     125     126     127     128     129     130     131     132     133     134     135     136     137     138     139     140     141     142     143     144     145     146     147     148     149     150     151     152     153     154     155     156     157     158     159     160     161     162     163     164     165     166     167     168     169     170     171     172     173     174     175     176     177     178     179     180     181     182     183     184     185     186     187     188     189     190     191     192     193     194     195     196     197     198     199     200     201     202     203     204     205     206     207     208     209     210     211     212     213     214     215     216     217     218     219     220     221     222     223     224     225     226     227     228     229     230     231     232     233     234     235     236     237     238     239     240     241     242     243     244     245     246     247     248     249     250     251     252     253     254     255     00      01      02      03      04      05      06      07      08      09      0a      0b      0c      0d      0e      0f      1a      1b      1c      1d      1e      1f      2a      2b      2c      2d      2e      2f      3a      3b      3c      3d      3e      3f      4a      4b      4c      4d      4e      4f      5a      5b      5c      5d      5e      5f      6a      6b      6c      6d      6e      6f      7a      7b      7c      7d      7e      7f      8a      8b      8c      8d      8e      8f      9a      9b      9c      9d      9e      9f      a0      a1      a2      a3      a4      a5      a6      a7      a8      a9      aa      ab      ac      ad      ae      af      b0      b1      b2      b3      b4      b5      b6      b7      b8      b9      ba      bb      bc      bd      be      bf      c0      c1      c2      c3      c4      c5      c6      c7      c8      c9      ca      cb      cc      cd      ce      cf      d0      d1      d2      d3      d4      d5      d6      d7      d8      d9      da      db      dc      dd      de      df      e0      e1      e2      e3      e4      e5      e6      e7      e8      e9      ea      eb      ec      ed      ee      ef      f0      f1      f2      f3      f4      f5      f6      f7      f8      f9      fa      fb      fc      fd      fe      ff      %x:           
   z z 
                                                                  00     <0     H0     T0     `0     l0     x0     0     0     0     0     0     0     0     0     0     0     0    0    0     0    ,0    80    D0    P0    \0    h0    t0    0    0    0    0    0    0    0    0    0    0    0    0~    0{    0x    (0u    40r    @0o    L0l    X0i    d0f    p0c    |0`    0]    0Z    0W    0T    0Q    0N    0K    0H    0E    0B     0?    0<    09    $06    003    <00    H0-    T0*    `0'    l0$    x0!    0    0    0    0    0    0    0    0	    0    0    0     0    0     0    ,0    80    D0    P0    \0    h0    t0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    (0    40    @0    L0    X0    d0    p0    |0    0    0    0    0    0    0    0    0    0    0     0    0|    0y    $0v    00s    <0p    H0m    T0j    `0g    l0d    x0a    0^    0[    0X    0U    0R    0O    0L    0I    0F    0C    0@    0=    0:     07    ,04    801    D0.    P0+    \0(    h0%    t0"    0    0    0    0    0    0    0    0
    0    0    0    0    0    0    (0    40    @0    L0    X0    d0    p0    |0    0    0    0    0    0    0    0    0    0    0    	 0    	0    	0           g     t                                            
4    
P                   |   
  H    5      o  ұo o                            	`   	          o          o                        @>                                                                                                                                                                                                                                                                               P X ` p           	    	              ?            0            ( 8    H X    ` p    x    	     
                        0    P `   2 p    3     h     i     k     l     m ( 8   q H X   r h x   u     w     z     {  0    `                         H `   c x                    @ X    h                           0    P `                      8    X p                     (    @ X                          7(    70    78    7@   7H5   7P    7X`   7``   7h`   7p`   7x`   78   7[   7\   7   7   7    7Ȁ>   7Ѐ<           7    7 B   7    7                                                                      	   	   
   
   c   c      d      e      f      g   h   h      j   2   2   3   3   i   i   k   k   l   l   q   q   r   r   s   s   u   u   v   v   w   w   x   x   y   y   z   z   {   {   |   |   }   }   ~   ~                                                                                                                                                                                                                                              x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                                      ( 0 8 @ H P X ` ( 0 8 @ H P h p x        X ` h p x                        ( 0 8 @ H P       X ` h p x                          ( 0 8 @         ( 0 8 @ H P X ` h p H P X ` h p x    x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x                        ( 0 8 @ H P X ` h p x          j p                  zP |P                0    -	       zPL |P               h       -	      @ P  d       -	      `    D       -	         x       -	       d  b z   -	                 -	       'x  h       -	       (  	0       -	       2           -	     @ 20   l       -	     ` 6  ,       -	      9         -	      ?          -	      @`         -	      B           -	       B         -	       
d   (       -	     @ 
   d {   -	     ` 
|  (       -	      
   `       -	      
L   p       -	      
          -	      
   d       -	       
   l       -	       
   8       -	     @ 
p   (       -	     ` 
   | {/   -	      
8   0       -	      
   l       -	      
    {P   -	      
   @       -	       
x   8       -	       
X   8       -	     @ 
8   H       -	     ` 
X   (       -	      
   L       -	      
    {   -	      
   0       -	      
   L       -	       
   L       -	       
   0       -	     @     <       -	     `    h       -	         h       -	         H       -	         4       -	          4       -	       h   p       -	       H   `       -	     @     <       -	     `    \       -	      P   h       -	      	    <       -	      	   4       -	      
    p       -	       
   <       -	       0   d       -	     @    4       -	       zPL |P             H\         -	      @ Q          -	      ` Q  0 {   -	       U   ,       -	       U   \       -	       V@  d       -	       Z  (|       -	                 -	       8          -	     @   |       -	     `          -	      P  <       -	               -	      x          -	        p       -	         x |   -	                -	     @ `         -	     `   $ |@   -	      
   (       -	      
   d |k   -	      
  (       -	      
0          -	       
(   d       -	       
   (       -	     @ 
<   | |   -	     ` 
h   0       -	      
<   l       -	      
,   `       -	      
P    |   -	      
8   @       -	       
    |   -	       
   0       -	     @ 
   8       -	     ` 
   8       -	      
`   L       -	      
   H       -	      
   0       -	       L   <       -	       0   h       -	           h       -	     @ P   H       -	     `    4       -	      4   4       -	         p       -	         `       -	      \   <       -	          \       -	          h       -	     @ 	\   <       -	     ` 	   4       -	      
p   p       -	         <       -	         d       -	      ,   4       -	       zP |P              ,   <    -	      <       -	      X Ո       -	      t l      -	             -	         ,    -	             -	              -	       `      -	             -	     8       -	     T        -	     p   D    -	      4   P    -	        D    -	            -	         T    -	            -	            -	     4        -	     P       -	     l       -	            -	      T      -	      d      -	      l      -	      t      -	             -	     0 t   H    -	     L   <    -	     h '  <    -	      *H  h    -	      -      -	      /      -	      4       -	      7      -	      9(  4    -	     , :\      -	     H ;p      -	     d >D  
    -	      HT  8    -	      I      -	      K,  	    -	      T      -	      ]P       -	      ^,      -	     ( _@   H    -	     D _   x    -	     ` `       -	     | a       -	      c   0    -	      c   0    -	      e      -	      h   0    -	      h@   0    -	     $ id       -	       zP |P              j       -	      < kt       -	      X l8  4    -	      t ml  0    -	       zP |P              n       -	      < o  d    -	      X xD      -	      t {      -	       |       -	       }  P    -	       D       -	       L      -	       zP |P                    -	      < (  |    -	      X       -	      t   H    -	             -	             -	         L    -	       <        -	               -	              -	       zPL |P             \         -	      @ X         -	      ` 0         -	          8p       -	                 -	       #         -	       *         -	       ,  T       -	       3   }(   -	     @ ?         -	     ` @0          -	      EP         -	      I         -	      Q  X       -	      T   x       -	       X         -	       ^l   h       -	     @ ^         -	       zPL |P             i    }   -	      @ o  
 ~   -	      ` y          -	       {<    ~U   -	       (         -	                -	         p       -	       l          -	       \          -	     @   d       -	     `           -	        d       -	               -	      8          -	      X   h       -	                -	         p       -	     @   ,       -	     ` 8         -	      @  	       -	      (  4       -	      \  T       -	      ְ   D       -	         $       -	         8       -	     @ P  (       -	     ` X   (       -	         d ~   -	      p   `       -	      0          -	      X   p       -	          (       -	       X   | ~   -	     @    0       -	     ` 0   8       -	         8       -	         H       -	      0       -	      !0   0       -	       !   (       -	       !   L       -	     @ #T   @       -	     ` $   h       -	      %   0       -	      %   h       -	      'D   H       -	      ($   p       -	       )   4       -	       )l   `       -	     @ *D   \       -	     ` *   h       -	      +   4       -	      ,4   p       -	      -   d       -	      .   4       -	       zPL |P             x          -	      @ p         -	      ` T   @       -	          @       -	          |       -	       P   |       -	          \       -	       (   \       -	         p       -	     @ $   |       -	     `    x       -	                -	                -	      0         -	               -	          , L   -	       /   ,       -	     @ ,  , w   -	     `          -	                -	      H  <    -	      /           -	        <    -	          `   -	       	      -	     @   	       -	     `   <       -	               -	             -	      04           -	          "   -	       T   Z   -	           x   -	     @ !         -	     ` "         -	      %      -	      +  $       -	      0@  d       -	      1  8       -	       6         -	       8p          -	     @ 9L  ,       -	     ` =x         -	      ?\         -	      B   
T       -	      LT  L       -	      N          -	       O  d       -	       Q4         -	     @ X          -	     ` Y          -	      [  h       -	      _T   d       -	      _         -	      ad         -	       d0      -	       j  h     -	     @ n@   K   -	     ` y         -	      z         -	      |         -	      }         -	      ~         -	       @         -	         ,       -	     @          -	     `          -	      10   ,       -	        	$       -	      L  d       -	               -	     	           -	     	    `       -	     	@          -	     	` Ŵ  (       -	     	   4 v   -	     	 2\       -	     	   
       -	     	 ۜ         -	     
  3H   `       -	     
  3   (       -	     
@ 4   X    -	     
` 4   `       -	     
 5@   (       -	     
 5h   X    -	     
 6    (       -	     
 6H   d    -	       6   (       -	       7   d 3   -	     @ 7   ,       -	     ` 7   (       -	      8T   d       -	      9   @       -	      9D   @       -	      9   (       -	       :<   ,       -	       :h          -	     @ 
   `       -	     ` 
   p       -	      <<   H       -	      <   L       -	      =0   L       -	      =|   l       -	       =   8       -	       >    0       -	     @ >P   (       -	     ` >x   `       -	      >   0       -	      ?   `       -	      ?h   L       -	      ?   `       -	       @          -	       A   h       -	     @ Bh          -	     ` B   H       -	      C   l       -	      C   8       -	      
   (       -	      
   0       -	       D<   L       -	       D   H       -	     @ D   ,       -	     ` D   (       -	      E$   d       -	      E    Q   -	      F   p       -	      G   ,       -	       G<   (       -	       Gd   d       -	     @ G       -	     ` H   p       -	      Ip   (       -	      I       -	      J|   0       -	      J   (       -	       J   x    -	       K   0       -	     @ K   8       -	     ` L4   8       -	      Ll   L       -	      L   P       -	      
   8       -	      
   8       -	       
   H       -	       
D   L       -	     @ M(   D       -	     ` Ml   P       -	      M   X       -	      Nd   `       -	      N   p       -	      OX   P       -	       O   8       -	       O   8       -	     @ P   D       -	     ` P\   h       -	      P   H       -	      Q   p       -	      Q   l       -	      R        -	       R   @       -	       SL  T @   -	     @ W   D       -	     ` X   d       -	      Y   ,       -	      Y   d       -	      Z   ,       -	      \H   @       -	       \       -	       ]p      -	     @ c  <     -	     ` ih   p       -	      i   h       -	      jX   0       -	      j   <       -	      j   h       -	       kT   h       -	       k    @   -	     @ n(   ,       -	     ` n   d       -	      oL   H       -	      o   T       -	      p4   D       -	      px   <       -	       p   h       -	       qd   l       -	     @ q   <       -	     ` r   T       -	      r`   0       -	      r   h       -	      s    P       -	      sp   H       -	       s   d       -	       t4   @       -	     @ t   p       -	     ` u   ,       -	      v   @       -	      v   ,       -	      w   4       -	      w   4       -	       x   p       -	       x   4       -	     @ y$   L       -	     ` yp   ,       -	      y   `       -	      y   H       -	      zP   T       -	      z   \       -	       {    @       -	       {   <       -	     @ {   \       -	     ` |   T       -	      }   h       -	      ~   4       -	      ~   <       -	      4   4       -	       h   \       -	          p       -	     @ 4   T       -	     `    <       -	         d       -	      8   4       -	       zP |P                 D    -	      < T      -	      X <       -	      t \       -	              -	             -	             -	             -	       ;       -	       zP |P                     -	      < (       -	      X        -	      t       -	       zP |P              
<      -	      <        -	      X   `    -	      t (      -	       zP |P                    -	      <        -	      X D       -	      t       -	       zP |P                    -	      < $       -	      X %X   t    -	      t %      -	       ,X  	    -	       6D      -	       B@       -	       zP |P              F      -	      < H      -	      X M|  ,    -	      t S      -	       U       -	       V       -	       Z,  T    -	       _      -	       b4       -	      c       -	     8 f  p    -	     T id  l    -	     p k      -	      m  p    -	       zP |P              sT   0    -	      < s   0    -	      X tl        -	      t t       -	       u       -	       v0   h    -	       v       -	       w      -	       }      -	             -	     8         -	     T        -	     p 0   @    -	      p   P    -	         p    -	      0   |    -	         <    -	             -	       zP |P                      -	      <         -	      X    t    -	      t l      -	             -	             -	             -	       \      -	       X       -	      $       -	       zPL |P             8   h    -	      @    h    -	      `          -	          ,       -	          h    -	       $   h    -	                 -	       8          -	                -	     @ (          -	     `    h       -	                -	                -	      $   h       -	                -	                  -	          X       -	     @ @          -	     ` `   t       -	                -	      `          -	                -	               -	       $   d       -	          d       -	     @    d       -	     ` P   t       -	       zP |P                     -	      < (       -	      X    x    -	      t ,   x    -	          L    -	       l      -	       zPL |P                      -	      @ Š         -	      ` l         -	                 -	       Ӽ         -	       ظ  	       -	       <         -	         4       -	             -	     @    f   -	     ` H      -	            -	      P         -	                -	               -	                 -	       l         -	     @  x         -	     `    t       -	                -	         B   -	      	T   l       -	      	    m   -	       
  $       -	              -	     @ ,       -	     `   $    -	        $    -	               -	      ,   l       -	        D       -	         8       -	       D          -	     @ D          -	     ` D          -	                -	      |          -	      h   p       -	               -	       "         -	       #         -	     @ $  0       -	     ` +  4       -	      ,          -	      -  @    -	                 -	      4   @    -	       :`   R   -	       >      -	     @ A  $       -	     ` B         -	      C  h       -	      HP         -	      I  d       -	      M4  T       -	       O  H       -	       R  l       -	     @ V<  X       -	     ` Y  P       -	      \         -	      h         -	      n  (       -	      o,  8       -	       qd      -	          (       -	     @ 8   d    -	     `    (       -	         d    -	         (       -	         d )   -	         (       -	     	     0       -	     	     L       -	     	@ $   H       -	     	`           -	     	    (       -	     	 D   0       -	     	 t   t       -	     	    L       -	     
  !   (       -	     
  !`   0       -	     
@ L   L       -	     
`    H       -	     
           -	     
           -	     
 t          -	     
 H   (       -	       p   d G   -	          (       -	     @    0       -	     ` D   L       -	         H       -	      4   (       -	      \   X e   -	      
   `       -	       
,   p       -	          H       -	     @ ;          -	     ` 4   ,       -	      `   (       -	         `       -	      x   t       -	         L       -	       d   @       -	          @       -	     @ 
   (       -	     `    (       -	      ,   |    -	         0       -	      0   (       -	         |    -	           0       -	       8   (       -	     @ `   |    -	     `    0       -	             -	        \       -	      0        -	          `   -	              -	       0   (       -	     @ X   |    -	     `    0       -	             -	         p       -	      
    8       -	      
    8       -	       
   H       -	       
   L       -	     @    D       -	     ` l   ,       -	         (       -	         d       -	      <          -	         P       -	          @       -	       #   @       -	     @ d   @       -	     `    h       -	      <   `       -	         0       -	         h       -	      `   H       -	       %$   h       -	          `       -	     @ %   0       -	     ` &T   h       -	      '   H       -	         h       -	      X   `       -	         0       -	          h       -	       |   H       -	     @    h       -	     ` ,   `       -	         0       -	         h       -	      P   H       -	         @       -	          ,       -	       $    8   -	     @    d       -	     `    p       -	      D   8       -	      |   8       -	         H       -	         4       -	       0   `       -	       (   p       -	     @ h   8       -	     `    8       -	      X   H       -	      )8   4       -	      )   `       -	         p       -	          8       -	       D   8       -	     @ |   H       -	     `    4       -	         `       -	      d   p       -	         8       -	         8       -	       D   H       -	          4       -	     @    `       -	     `    ,       -	         \       -	          h       -	      *   \       -	      +d   h       -	          \       -	           h       -	     @    \       -	     `     h       -	         @       -	         4       -	         p       -	      ,    4       -	       ,   p       -	          4       -	     @    p       -	     ` $   4       -	      X   p       -	      4   d       -	      .P   d       -	         d       -	          d       -	       8   4       -	     @ .   4       -	     ` l   4       -	          4       -	       zP |P              x8       -	      < yX       -	      X zx  D    -	      t        -	       {  D    -	       }   0    -	       0       -	       |  <    -	       zP |P                x    -	      < H       -	      X 0      -	       zP |P                     -	      <    t    -	      X   h    -	      t t      -	       zPL |P             4         -	      @           -	      ` p  l       -	                 -	       \  L       -	          X       -	          d       -	       d  p       -	                -	     @ h         -	     ` X  4       -	               -	         x   -	      Ĥ      -	      ż           -	       4         -	                -	     @   <       -	     `   ,       -	         P       -	      D      -	               -	         (       -	       D   `       -	       Ƽ   ,       -	     @    (       -	     ` Ǡ   ,       -	         @       -	      8   @       -	      x   H       -	         ,       -	          (       -	       ɼ   L       -	     @ <   H       -	     ` ʸ          -	      ˘   X :   -	         H       -	      X   H       -	      ̸   ,       -	          (       -	       ͜   `       -	     @     X   -	     `    ,       -	          (       -	      (   d       -	      Ϭ   p       -	      D   P       -	       Д   D       -	       d   D       -	     @ Ѩ   D       -	     `    ,       -	      8   (       -	      `   d       -	      H   d       -	      Ӽ   ,       -	              -	       Ԑ       -	     @ (       -	     `    d       -	      \   ,       -	         ,       -	      t   ,       -	         ,       -	       \   ,       -	       ٔ   @       -	     @    @       -	     `    @       -	      ̈  < P   -	      T           -	      t   X    -	         p       -	     	  ۜ           -	     	  ۼ   X    -	     	@ d   p       -	     	`    (       -	     	    (       -	     	    $       -	     	    $       -	         
u                         J  _   M     M   M    _   O     O   Ph    _   _          `,                 (    D           0      @    \           P=4              8      P   l      |                  P=4                       8                   A   0      @    `             `                       '     p       0     X   t  p     '      x       L     \   x  
p              (    D           0      @    \         P=4              8      P   l      |                  P=4                       8                      <      d                      t                  \     l                        D                       
                    4                                       A      t                    H       0     @   \       u                       \               `   H          t  t   `   (     8     \   `       $              (    D           0      @    \          P=4                       8                   '      |                  L     '      |                  L     [   4      D    d                            p                (        [   4      D    d                            p                (        A            $     4   h     x                   A            $     4   h     x                   4   ,      <    \                             4   ,      <    \                                  <  |                <  |           [   ,                   $                  4  (       h     x     0     '   (           8      H    d  4     '               0      @    \       '   ,           <      L    h       '   (   8        t            |     4   8      H    h                                           8                     8                 (    D                 (    D        4   ,      <    \           x                  4   ,      <    \           x                     X      h               ,      <    X           P=4              8      P   l      |                  P=4                       8     ,              P=4              0      @   X      h                  P=4            4       8   8  p                 P=4   `                 0   8  h                 P=4              0      @   X      h                  '                     0    T        '                     0    T                     @                     @          N   ,      <    \                             h     x           N   ,      <    \                             h     x           A     (  l                   (     8   \        A     (  l                   (     8   \        '     \                      '   D           T      d       (        $      4    T           $      4    T                                                   ,      <    \                             X        H     X     D             (                        ,           ,      <    \                             X        H     X     D             (                        ,        4               (   \     l           4               (   \     l           '      D        `      p      ,              (    D                 (    D                 (    D                 (    D                     8           0      @    \           0      @    \           0      @    \           P=4                       8                   P=4                       8                   P=4                       8                   P=4                       8                      0      @    \        4   ,      <    \           x                    P=4              0      @   X      h                  '                            4   ,      <    \                            [     $       H     X   t         @     P   l         	     	   	                    8        4   ,      <    \           x                  P=4              0      @   X      h                  P=4              0      @   X      h                  P=4              0      @   X      h                  h   T      d                                  t                  4     D                       8                     8         as: Sun WorkShop 6 99/08/18
  as: Sun WorkShop 6 99/08/18
  @(#)SunOS 5.8 Generic February 2000  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.3.2  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 GCC: (GNU) 3.4.6  as: Sun WorkShop 6 99/08/18
 ld: Software Generation Utilities - Solaris-ELF (4.0) %  $ >  $ >   :;I  :;   :;I8
   :;I8
   I  	& I  
.?:;'@
   :;I
  I  ! I/  4 :;I?<               
 
քGNU C 3.4.6 ../../gcc/libgcc2.c /sol10/SOURCES/S8/gcc-3.4.6/objdir/gcc int     long int __FILE      /__FILE _cnt ,  /# _ptr -  >#_base /  >#_flag 0  D#_file 1  D#__orientation 2   g#__ionolock 3   g#__filler 4   g# ssize_t    `  Dunsigned char long long int     char short int short unsigned int long long unsigned int long unsigned int   	  msigned char float double long double 
  j__eprintf  
֌ 
nstring   hexpression   iline    gjfilename   k   z   z  f __iob   j      
    ../../gcc /sol10/SOURCES/S8/gcc-3.4.6/objdir/gcc/include /usr/include /usr/include/sys  stddef.h   stdarg.h   va_list.h   stdio_tag.h   stdio_impl.h   iso/stdio_iso.h   stdio.h   machtypes.h   int_types.h   sys/types.h   time.h   iso/time_iso.h   time_impl.h   time.h   select.h   iso/stdlib_iso.h   stdlib.h   config/sparc/sparc.h   libgcc2.h   libgcc2.c      
֌  
֐  
֔  
֠  
  
  
      |         
֌   H   -	             __eprintf                   
ք   P        unsigned int  .interp .hash .dynsym .dynstr .SUNW_version .rela.got .rela.bss .rela.plt .text .init .fini .gnu.linkonce.t._ZSt6strchrPci .gnu.linkonce.t._ZSt7strrchrPci .gnu.linkonce.t._ZN6Target8HostNameEv .gnu.linkonce.t._ZN6Target11targetipstrEv .gnu.linkonce.t._ZN6Target10deviceNameEv .gnu.linkonce.t._ZN7NmapOps21getMaxRetransmissionsEv .gnu.linkonce.t._ZN7NmapOps13maxRttTimeoutEv .gnu.linkonce.t._ZN7NmapOps13minRttTimeoutEv .gnu.linkonce.t._ZN7NmapOps17initialRttTimeoutEv .gnu.linkonce.t._ZN7NmapOps14maxHostGroupSzEv .gnu.linkonce.t._ZN7NmapOps14minHostGroupSzEv .gnu.linkonce.t._ZN7NmapOps13XSLStyleSheetEv .gnu.linkonce.t._ZN7NmapOps18setMaxUDPScanDelayEj .gnu.linkonce.t._ZN7NmapOps15maxUDPScanDelayEv .gnu.linkonce.t._ZN7NmapOps15maxTCPScanDelayEv .gnu.linkonce.t._ZN7NmapOps18setMaxTCPScanDelayEj .gnu.linkonce.t._ZN7NmapOps2afEv .gnu.linkonce.t._ZN7NmapOps5setafEi .gnu.linkonce.t._ZN7NmapOps15setVersionTraceEb .gnu.linkonce.t._ZN7NmapOps14setPacketTraceEb .gnu.linkonce.t._ZSt6strstrPcPKc .gnu.linkonce.t._ZNSaIP6TargetEC1Ev .gnu.linkonce.t._ZNSaIP6TargetED1Ev .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EED1Ev .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE7reserveEj .gnu.linkonce.t._ZNKSt6vectorIP6TargetSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EEixEj .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNKSt6vectorIP6TargetSaIS1_EE5emptyEv .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE4backEv .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE8pop_backEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP6TargetEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP6TargetED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIP6TargetSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSt12_Vector_baseIP6TargetSaIS1_EED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIP6TargetSaIS1_EE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaIP6TargetED2Ev .gnu.linkonce.t._ZSt8_DestroyIPP6TargetEvT_S3_ .gnu.linkonce.t._ZNKSt6vectorIP6TargetSaIS1_EE8max_sizeEv .gnu.linkonce.t._ZNKSt6vectorIP6TargetSaIS1_EE8capacityEv .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE20_M_allocate_and_copyIPS1_EES5_jT_S6_ .gnu.linkonce.t._ZNSt12_Vector_baseIP6TargetSaIS1_EE13_M_deallocateEPS1_j .gnu.linkonce.t._ZNKSt6vectorIP6TargetSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt6vectorIP6TargetSaIS1_EE5beginEv .gnu.linkonce.t._ZN9__gnu_cxxmiIPKP6TargetS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE5beginEv .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEplERKi .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEdeEv .gnu.linkonce.t._ZSt10_ConstructIP6TargetS1_EvPT_RKT0_ .gnu.linkonce.t._ZnwjPv .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ .gnu.linkonce.t._ZNSt6vectorIP6TargetSaIS1_EE3endEv .gnu.linkonce.t._ZN9__gnu_cxxeqIPKP6TargetSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESD_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEmiERKi .gnu.linkonce.t._ZSt8_DestroyIP6TargetEvPT_ .gnu.linkonce.t._ZNSt12_Vector_baseIP6TargetSaIS1_EE12_Vector_implC1ERKS2_ .gnu.linkonce.t._ZNSaIP6TargetEC2ERKS1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP6TargetEC2ERKS3_ .gnu.linkonce.t._ZSt13__destroy_auxIPP6TargetEvT_S3_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPKP6TargetSt6vectorIS2_SaIS2_EEEC1ERKS4_ .gnu.linkonce.t._ZNSt12_Vector_baseIP6TargetSaIS1_EE11_M_allocateEj .gnu.linkonce.t._ZSt18uninitialized_copyIPP6TargetS2_ET0_T_S4_S3_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP6TargetE10deallocateEPS2_j .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPKP6TargetSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEC1ERKS3_ .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEppEv .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEEEvT_S9_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP6TargetE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIPP6TargetS2_ET0_T_S4_S3_11__true_type .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type .gnu.linkonce.t._ZSt4copyIPP6TargetS2_ET0_T_S4_S3_ .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIPP6TargetN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZSt10__copy_ni1IPP6TargetS2_ET0_T_S4_S3_12__false_type .gnu.linkonce.t._ZSt19__copy_backward_auxIPP6TargetS2_ET0_T_S4_S3_ .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt10__copy_ni2IPP6TargetS2_ET0_T_S4_S3_12__false_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIPP6TargetS2_11__true_typeE4copyEPKS1_S6_S2_ .gnu.linkonce.t._ZSt10__copy_ni2IPP6TargetN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt11__copy_aux2IP6TargetEPT_S3_S3_S3_11__true_type .gnu.linkonce.t._ZSt14__copy_trivialIP6TargetEPT_PKS2_S5_S3_ .gnu.linkonce.t._ZN11TargetGroup8get_maskEv .gnu.linkonce.t._ZN11TargetGroup16get_targets_typeEv .gnu.linkonce.t._ZN6Target6ifTypeEv .gnu.linkonce.t._ZN7NmapOps15spoofMACAddressEv .gnu.linkonce.t._ZN6Target9setIfTypeE7devtype .gnu.linkonce.t._ZN7NmapOps11packetTraceEv .gnu.linkonce.t._ZN13PacketCounterC1Ev .gnu.linkonce.t._ZN15idle_proxy_infoD1Ev .gnu.linkonce.t._ZN15idle_proxy_infoC1Ev .gnu.linkonce.t._ZNSaIPKcEC1Ev .gnu.linkonce.t._ZNSaIPKcED1Ev .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EED1Ev .gnu.linkonce.t._ZNKSt6vectorIPKcSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EEixEj .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIPKcEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIPKcED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIPKcSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSt12_Vector_baseIPKcSaIS1_EED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIPKcSaIS1_EE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaIPKcED2Ev .gnu.linkonce.t._ZSt8_DestroyIPPKcEvT_S3_ .gnu.linkonce.t._ZNKSt6vectorIPKcSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt6vectorIPKcSaIS1_EE5beginEv .gnu.linkonce.t._ZN9__gnu_cxxmiIPKPKcS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE .gnu.linkonce.t._ZSt10_ConstructIPKcS1_EvPT_RKT0_ .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EE3endEv .gnu.linkonce.t._ZNSt6vectorIPKcSaIS1_EE5beginEv .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEplERKi .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEdeEv .gnu.linkonce.t._ZNSt12_Vector_baseIPKcSaIS1_EE12_Vector_implC1ERKS2_ .gnu.linkonce.t._ZNSaIPKcEC2ERKS1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIPKcEC2ERKS3_ .gnu.linkonce.t._ZNSt12_Vector_baseIPKcSaIS1_EE13_M_deallocateEPS1_j .gnu.linkonce.t._ZSt13__destroy_auxIPPKcEvT_S3_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPKPKcSt6vectorIS2_SaIS2_EEEC1ERKS4_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPKPKcSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEC1ERKS3_ .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZNSt12_Vector_baseIPKcSaIS1_EE11_M_allocateEj .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEppEv .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEEEvT_S9_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIPKcE10deallocateEPS2_j .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIPKcE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIPPKcN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZSt19__copy_backward_auxIPPKcS2_ET0_T_S4_S3_ .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIPPKcS2_11__true_typeE4copyEPKS1_S6_S2_ .gnu.linkonce.t._ZSt10__copy_ni2IPPKcN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt11__copy_aux2IPKcEPT_S3_S3_S3_11__true_type .gnu.linkonce.t._ZSt14__copy_trivialIPKcEPT_PKS2_S5_S3_ .gnu.linkonce.t._ZN13UltraScanInfo18numIncompleteHostsEv .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EED1Ev .gnu.linkonce.t._ZN10UltraProbe6isPingEv .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EED1Ev .gnu.linkonce.t._ZN10UltraProbe2CPEv .gnu.linkonce.t._ZN10UltraProbe5pspecEv .gnu.linkonce.t._ZN13HostScanStats11nextPingSeqEb .gnu.linkonce.t._ZN10UltraProbe8protocolEv .gnu.linkonce.t._ZN13HostScanStats22num_probes_outstandingEv .gnu.linkonce.t._ZN13UltraScanInfo15numInitialHostsEv .gnu.linkonce.t._ZN10UltraProbe4ipidEv .gnu.linkonce.t._ZN10UltraProbe5sportEv .gnu.linkonce.t._ZN10UltraProbe5dportEv .gnu.linkonce.t._ZN13UltraScanInfoC1ERSt6vectorIP6TargetSaIS2_EEP10scan_lists5stype .gnu.linkonce.t._ZNKSt4listIP10UltraProbeSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSaIP13HostScanStatsEC1Ev .gnu.linkonce.t._ZNSaIP13HostScanStatsED1Ev .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EE10_List_implD1Ev .gnu.linkonce.t._ZNSt14_List_iteratorIP13HostScanStatsEC1Ev .gnu.linkonce.t._ZNKSt4listIP13HostScanStatsSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSaIP10UltraProbeEC1Ev .gnu.linkonce.t._ZNSaIP10UltraProbeED1Ev .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EE10_List_implD1Ev .gnu.linkonce.t._ZNSaI9probespecEC1Ev .gnu.linkonce.t._ZNSaI9probespecED1Ev .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EEC1ERKS1_ .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EED1Ev .gnu.linkonce.t._ZNSaIhEC1Ev .gnu.linkonce.t._ZNSaIhED1Ev .gnu.linkonce.t._ZNSt6vectorIhSaIhEEC1ERKS0_ .gnu.linkonce.t._ZNSt6vectorIhSaIhEED1Ev .gnu.linkonce.t._ZNSt14_List_iteratorIP10UltraProbeEC1Ev .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP10UltraProbeEneERKS2_ .gnu.linkonce.t._ZNSt14_List_iteratorIP10UltraProbeEppEi .gnu.linkonce.t._ZNKSt6vectorI9probespecSaIS0_EE5emptyEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP10UltraProbeEdeEv .gnu.linkonce.t._ZNKSt4listIP13HostScanStatsSaIS1_EE5emptyEv .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE5frontEv .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE9pop_frontEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP13HostScanStatsEdeEv .gnu.linkonce.t._ZNSt14_List_iteratorIP13HostScanStatsEppEi .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP13HostScanStatsEeqERKS2_ .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE5beginEv .gnu.linkonce.t._Z3boxIiET_S0_S0_S0_ .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNKSt14_List_iteratorIP13HostScanStatsEneERKS2_ .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE5eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNKSt4listIP10UltraProbeSaIS1_EE5emptyEv .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE5eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE4backEv .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE8pop_backEv .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE3endEv .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE5beginEv .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE6insertIN9__gnu_cxx17__normal_iteratorIPS0_S2_EEEEvS7_T_S8_ .gnu.linkonce.t._ZNSt6vectorIhSaIhEE3endEv .gnu.linkonce.t._ZNKSt6vectorI9probespecSaIS0_EE4sizeEv .gnu.linkonce.t._ZNSt6vectorIhSaIhEE6insertIjEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S7_ .gnu.linkonce.t._ZNKSt6vectorIhSaIhEE4sizeEv .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE5eraseEN9__gnu_cxx17__normal_iteratorIPS0_S2_EES6_ .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE7reserveEj .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE9push_backERKS0_ .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP10UltraProbeEmmEi .gnu.linkonce.t._ZNSt6vectorIhSaIhEE4backEv .gnu.linkonce.t._ZNSt6vectorIhSaIhEE8pop_backEv .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEC1Ev .gnu.linkonce.t._ZN9__gnu_cxxneIPP6TargetSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP6TargetSt6vectorIS2_SaIS2_EEEppEi .gnu.linkonce.t._ZNKSt4listIP10UltraProbeSaIS1_EE5beginEv .gnu.linkonce.t._ZNKSt4listIP10UltraProbeSaIS1_EE3endEv .gnu.linkonce.t._ZSt8distanceISt20_List_const_iteratorIP10UltraProbeEENSt15iterator_traitsIT_E15difference_typeES5_S5_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP13HostScanStatsEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP13HostScanStatsED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSaISt10_List_nodeIP13HostScanStatsEED2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP13HostScanStatsEED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EE8_M_clearEv .gnu.linkonce.t._ZNKSt4listIP13HostScanStatsSaIS1_EE5beginEv .gnu.linkonce.t._ZNKSt4listIP13HostScanStatsSaIS1_EE3endEv .gnu.linkonce.t._ZSt8distanceISt20_List_const_iteratorIP13HostScanStatsEENSt15iterator_traitsIT_E15difference_typeES5_S5_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP10UltraProbeEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP10UltraProbeED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSaISt10_List_nodeIP10UltraProbeEED2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP10UltraProbeEED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EE8_M_clearEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorI9probespecEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorI9probespecED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseI9probespecSaIS0_EEC2ERKS1_ .gnu.linkonce.t._ZNSt12_Vector_baseI9probespecSaIS0_EED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseI9probespecSaIS0_EE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaI9probespecED2Ev .gnu.linkonce.t._ZSt8_DestroyIP9probespecEvT_S2_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIhEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIhED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIhSaIhEEC2ERKS0_ .gnu.linkonce.t._ZNSt12_Vector_baseIhSaIhEED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIhSaIhEE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaIhED2Ev .gnu.linkonce.t._ZSt8_DestroyIPhEvT_S1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP10UltraProbeEC1EPSt15_List_node_base .gnu.linkonce.t._ZNKSt6vectorI9probespecSaIS0_EE5beginEv .gnu.linkonce.t._ZNKSt6vectorI9probespecSaIS0_EE3endEv .gnu.linkonce.t._ZN9__gnu_cxxeqIPK9probespecSt6vectorIS1_SaIS1_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNSt14_List_iteratorIP13HostScanStatsEC1EPSt15_List_node_base .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEmiERKi .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEdeEv .gnu.linkonce.t._ZSt8_DestroyI9probespecEvPT_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEC1ERKS2_ .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE18_M_insert_dispatchIN9__gnu_cxx17__normal_iteratorIPS0_S2_EEEEvS7_T_S8_12__false_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEC1ERKS1_ .gnu.linkonce.t._ZN9__gnu_cxxmiIPK9probespecS3_St6vectorIS1_SaIS1_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSA_RKNS7_IT0_S9_EE .gnu.linkonce.t._ZNSt6vectorIhSaIhEE18_M_insert_dispatchIjEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S7_11__true_type .gnu.linkonce.t._ZNKSt6vectorIhSaIhEE3endEv .gnu.linkonce.t._ZNKSt6vectorIhSaIhEE5beginEv .gnu.linkonce.t._ZN9__gnu_cxxmiIPKhS2_St6vectorIhSaIhEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS9_RKNS6_IT0_S8_EE .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_ .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEEvT_S8_ .gnu.linkonce.t._ZN9__gnu_cxxmiIP9probespecS2_St6vectorIS1_SaIS1_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS9_RKNS6_IT0_S8_EE .gnu.linkonce.t._ZNKSt6vectorI9probespecSaIS0_EE8max_sizeEv .gnu.linkonce.t._ZNKSt6vectorI9probespecSaIS0_EE8capacityEv .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE20_M_allocate_and_copyIPS0_EES4_jT_S5_ .gnu.linkonce.t._ZNSt12_Vector_baseI9probespecSaIS0_EE13_M_deallocateEPS0_j .gnu.linkonce.t._ZSt10_ConstructI9probespecS0_EvPT_RKT0_ .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS0_S2_EERKS0_ .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEmiERKi .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEdeEv .gnu.linkonce.t._ZSt8_DestroyIhEvPT_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP10UltraProbeEC1EPKSt15_List_node_base .gnu.linkonce.t._ZSt19__iterator_categoryISt20_List_const_iteratorIP10UltraProbeEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ .gnu.linkonce.t._ZSt10__distanceISt20_List_const_iteratorIP10UltraProbeEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag .gnu.linkonce.t._ZNSaISt10_List_nodeIP13HostScanStatsEEC1IS1_EERKSaIT_E .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EE7_M_initEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEED2Ev .gnu.linkonce.t._ZSt8_DestroyIP13HostScanStatsEvPT_ .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E .gnu.linkonce.t._ZNSt20_List_const_iteratorIP13HostScanStatsEC1EPKSt15_List_node_base .gnu.linkonce.t._ZSt19__iterator_categoryISt20_List_const_iteratorIP13HostScanStatsEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ .gnu.linkonce.t._ZSt10__distanceISt20_List_const_iteratorIP13HostScanStatsEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag .gnu.linkonce.t._ZNSaISt10_List_nodeIP10UltraProbeEEC1IS1_EERKSaIT_E .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EE7_M_initEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEED2Ev .gnu.linkonce.t._ZSt8_DestroyIP10UltraProbeEvPT_ .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E .gnu.linkonce.t._ZNSt12_Vector_baseI9probespecSaIS0_EE12_Vector_implC1ERKS1_ .gnu.linkonce.t._ZNSaI9probespecEC2ERKS0_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorI9probespecEC2ERKS2_ .gnu.linkonce.t._ZSt13__destroy_auxIP9probespecEvT_S2_12__false_type .gnu.linkonce.t._ZNSt12_Vector_baseIhSaIhEE12_Vector_implC1ERKS0_ .gnu.linkonce.t._ZNSaIhEC2ERKS_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIhEC2ERKS1_ .gnu.linkonce.t._ZNSt12_Vector_baseIhSaIhEE13_M_deallocateEPhj .gnu.linkonce.t._ZSt13__destroy_auxIPhEvT_S1_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPK9probespecSt6vectorIS1_SaIS1_EEEC1ERKS3_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPK9probespecSt6vectorIS1_SaIS1_EEE4baseEv .gnu.linkonce.t._ZNSt4listIP13HostScanStatsSaIS1_EE14_M_create_nodeERKS1_ .gnu.linkonce.t._ZNSt6vectorI9probespecSaIS0_EE15_M_range_insertIN9__gnu_cxx17__normal_iteratorIPS0_S2_EEEEvS7_T_S8_St20forward_iterator_tag .gnu.linkonce.t._ZNSt6vectorIhSaIhEE14_M_fill_insertEN9__gnu_cxx17__normal_iteratorIPhS1_EEjRKh .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPKhSt6vectorIhSaIhEEEC1ERKS2_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPKhSt6vectorIhSaIhEEE4baseEv .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEEvT_S8_12__false_type .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEE4baseEv .gnu.linkonce.t._ZNSt12_Vector_baseI9probespecSaIS0_EE11_M_allocateEj .gnu.linkonce.t._ZSt18uninitialized_copyIP9probespecS1_ET0_T_S3_S2_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorI9probespecE10deallocateEPS1_j .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_ .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEppEv .gnu.linkonce.t._ZNSt4listIP10UltraProbeSaIS1_EE14_M_create_nodeERKS1_ .gnu.linkonce.t._ZNKSt20_List_const_iteratorIP10UltraProbeEneERKS2_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP10UltraProbeEppEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEEC2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP13HostScanStatsEEC2ERKS3_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEE10deallocateEPS4_j .gnu.linkonce.t._ZNKSt20_List_const_iteratorIP13HostScanStatsEneERKS2_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP13HostScanStatsEppEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEEC2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP10UltraProbeEEC2ERKS3_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEE10deallocateEPS4_j .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIhE10deallocateEPhj .gnu.linkonce.t._ZNSt10_List_baseIP13HostScanStatsSaIS1_EE11_M_get_nodeEv .gnu.linkonce.t._ZSt10_ConstructIP13HostScanStatsS1_EvPT_RKT0_ .gnu.linkonce.t._ZN9__gnu_cxxneIP9probespecSt6vectorIS1_SaIS1_EEEEbRKNS_17__normal_iteratorIT_T0_EESB_ .gnu.linkonce.t._ZSt8distanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEENSt15iterator_traitsIT_E15difference_typeES9_S9_ .gnu.linkonce.t._ZSt7advanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEjEvRT_T0_ .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES3_ET0_T_S9_S8_ .gnu.linkonce.t._ZSt3maxIjERKT_S2_S2_ .gnu.linkonce.t._ZN9__gnu_cxxmiIPhS1_St6vectorIhSaIhEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS8_RKNS5_IT0_S7_EE .gnu.linkonce.t._ZSt18uninitialized_copyIPhS0_ET0_T_S2_S1_ .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEplERKi .gnu.linkonce.t._ZSt4fillIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEhEvT_S7_RKT0_ .gnu.linkonce.t._ZSt20uninitialized_fill_nIPhjhET_S1_T0_RKT1_ .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_ .gnu.linkonce.t._ZNSt12_Vector_baseIhSaIhEE11_M_allocateEj .gnu.linkonce.t._ZNSt6vectorIhSaIhEE5beginEv .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_ .gnu.linkonce.t._ZSt20uninitialized_fill_nIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEjhET_S7_T0_RKT1_ .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEEvT_S7_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEE4baseEv .gnu.linkonce.t._ZSt10__copy_ni2IP9probespecN9__gnu_cxx17__normal_iteratorIS1_St6vectorIS0_SaIS0_EEEEET0_T_S9_S8_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorI9probespecE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIP9probespecS1_ET0_T_S3_S2_12__false_type .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_11__true_type .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES7_ET0_T_S9_S8_12__false_type .gnu.linkonce.t._ZNSt10_List_baseIP10UltraProbeSaIS1_EE11_M_get_nodeEv .gnu.linkonce.t._ZSt10_ConstructIP10UltraProbeS1_EvPT_RKT0_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEEC2ERKS5_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEEC2ERKS5_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP13HostScanStatsEE8allocateEjPKv .gnu.linkonce.t._ZSt19__iterator_categoryIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEENSt15iterator_traitsIT_E17iterator_categoryERKS9_ .gnu.linkonce.t._ZSt10__distanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEENSt15iterator_traitsIT_E15difference_typeES9_S9_St26random_access_iterator_tag .gnu.linkonce.t._ZSt9__advanceIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEEjEvRT_T0_St26random_access_iterator_tag .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS2_SaIS2_EEEES3_ET0_T_S9_S8_12__false_type .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIPhS0_ET0_T_S2_S1_11__true_type .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZN9__gnu_cxxneIPhSt6vectorIhSaIhEEEEbRKNS_17__normal_iteratorIT_T0_EESA_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEppEv .gnu.linkonce.t._ZSt26__uninitialized_fill_n_auxIPhjhET_S1_T0_RKT1_11__true_type .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIhE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZSt26__uninitialized_fill_n_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEjhET_S7_T0_RKT1_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEEvT_S7_11__true_type .gnu.linkonce.t._ZSt11__copy_aux2IP9probespecS1_ET0_T_S3_S2_12__false_type .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIP9probespecN9__gnu_cxx17__normal_iteratorIS1_St6vectorIS0_SaIS0_EEEEET0_T_S9_S8_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10UltraProbeEE8allocateEjPKv .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIP9probespecSt6vectorIS1_SaIS1_EEEpLERKi .gnu.linkonce.t._ZSt4copyIPhS0_ET0_T_S2_S1_ .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIPhN9__gnu_cxx17__normal_iteratorIS0_St6vectorIhSaIhEEEEET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZSt6fill_nIjEPhS0_T_RKh .gnu.linkonce.t._ZSt4fillPhS_RKh .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_ .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_ .gnu.linkonce.t._ZSt6fill_nIN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEEjhET_S7_T0_RKT1_ .gnu.linkonce.t._ZSt19__iterator_categoryIP9probespecENSt15iterator_traitsIT_E17iterator_categoryERKS3_ .gnu.linkonce.t._ZSt6__copyIP9probespecS1_ET0_T_S3_S2_St26random_access_iterator_tag .gnu.linkonce.t._ZSt19__copy_backward_auxIP9probespecS1_ET0_T_S3_S2_ .gnu.linkonce.t._ZSt10__copy_ni1IPhS0_ET0_T_S2_S1_12__false_type .gnu.linkonce.t._ZSt19__copy_backward_auxIPhS0_ET0_T_S2_S1_ .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES2_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPhSt6vectorIhSaIhEEEES6_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIP9probespecS1_12__false_typeE4copyES1_S1_S1_ .gnu.linkonce.t._ZSt10__copy_ni2IPhS0_ET0_T_S2_S1_12__false_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIPhS0_11__true_typeE4copyEPKhS4_S0_ .gnu.linkonce.t._ZSt10__copy_ni2IPhN9__gnu_cxx17__normal_iteratorIS0_St6vectorIhSaIhEEEEET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZSt15__copy_backwardIP9probespecS1_ET0_T_S3_S2_St26random_access_iterator_tag .gnu.linkonce.t._ZSt11__copy_aux2IhEPT_S1_S1_S1_11__true_type .gnu.linkonce.t._ZSt14__copy_trivialIhEPT_PKS0_S3_S1_ .gnu.linkonce.t._ZSt7strpbrkPcPKc .gnu.linkonce.t._ZN17ServiceProbeMatch7getNameEv .gnu.linkonce.t._ZN12ServiceProbe11isNullProbeEv .gnu.linkonce.t._ZN12ServiceProbe16getProbeProtocolEv .gnu.linkonce.t._ZN12ServiceProbe7getNameEv .gnu.linkonce.t._ZN12ServiceProbe9getRarityEv .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EED1Ev .gnu.linkonce.t._ZN12ServiceProbe14getProbeStringEPi .gnu.linkonce.t._ZN6Target19timeOutClockRunningEv .gnu.linkonce.t._ZN7NmapOps12getStartTimeEv .gnu.linkonce.t._ZN7NmapOps12versionTraceEv .gnu.linkonce.t._ZNSaItEC1Ev .gnu.linkonce.t._ZNSaItED1Ev .gnu.linkonce.t._ZNSt6vectorItSaItEEC1ERKS0_ .gnu.linkonce.t._ZNSt6vectorItSaItEED1Ev .gnu.linkonce.t._ZNSaIP17ServiceProbeMatchEC1Ev .gnu.linkonce.t._ZNSaIP17ServiceProbeMatchED1Ev .gnu.linkonce.t._ZNSt6vectorIP17ServiceProbeMatchSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt6vectorIP17ServiceProbeMatchSaIS1_EED1Ev .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEC1Ev .gnu.linkonce.t._ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE3endEv .gnu.linkonce.t._ZN9__gnu_cxxneIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEppEi .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEdeEv .gnu.linkonce.t._ZNSt6vectorItSaItEE9push_backERKt .gnu.linkonce.t._ZNSt6vectorItSaItEE5beginEv .gnu.linkonce.t._ZNSt6vectorItSaItEE3endEv .gnu.linkonce.t._ZSt4findIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEtET_S7_S7_RKT0_ .gnu.linkonce.t._ZN9__gnu_cxxeqIPtSt6vectorItSaItEEEEbRKNS_17__normal_iteratorIT_T0_EESA_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEC1Ev .gnu.linkonce.t._ZN9__gnu_cxxneIPPKcSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPPKcSt6vectorIS2_SaIS2_EEEppEi .gnu.linkonce.t._ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNSt6vectorIP12ServiceProbeSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNSaIP12ServiceProbeEC1Ev .gnu.linkonce.t._ZNSaIP12ServiceProbeED1Ev .gnu.linkonce.t._ZNSt6vectorIP12ServiceProbeSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt6vectorIP12ServiceProbeSaIS1_EED1Ev .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEC1Ev .gnu.linkonce.t._ZNSt6vectorIP12ServiceProbeSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt6vectorIP12ServiceProbeSaIS1_EE3endEv .gnu.linkonce.t._ZN9__gnu_cxxneIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEEbRKNS_17__normal_iteratorIT_T0_EESC_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEppEi .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEdeEv .gnu.linkonce.t._ZNSaIP10ServiceNFOEC1Ev .gnu.linkonce.t._ZNSaIP10ServiceNFOED1Ev .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EE10_List_implD1Ev .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP10ServiceNFOEC1Ev .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP10ServiceNFOEneERKS2_ .gnu.linkonce.t._ZNSt14_List_iteratorIP10ServiceNFOEppEi .gnu.linkonce.t._ZNKSt14_List_iteratorIP10ServiceNFOEdeEv .gnu.linkonce.t._ZNKSt4listIP10ServiceNFOSaIS1_EE4sizeEv .gnu.linkonce.t._ZSt4findISt14_List_iteratorIP10ServiceNFOES2_ET_S4_S4_RKT0_ .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE5eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNKSt4listIP10ServiceNFOSaIS1_EE5emptyEv .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE5frontEv .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE9pop_frontEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorItEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorItED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseItSaItEEC2ERKS0_ .gnu.linkonce.t._ZNSt12_Vector_baseItSaItEED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseItSaItEE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaItED2Ev .gnu.linkonce.t._ZSt8_DestroyIPtEvT_S1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaIP17ServiceProbeMatchED2Ev .gnu.linkonce.t._ZSt8_DestroyIPP17ServiceProbeMatchEvT_S3_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEC1ERKS3_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZSt10_ConstructIttEvPT_RKT0_ .gnu.linkonce.t._ZNSt6vectorItSaItEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPtS1_EERKt .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEC1ERKS1_ .gnu.linkonce.t._ZSt19__iterator_categoryIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEENSt15iterator_traitsIT_E17iterator_categoryERKS8_ .gnu.linkonce.t._ZSt4findIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEtET_S7_S7_RKT0_St26random_access_iterator_tag .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEE4baseEv .gnu.linkonce.t._ZSt10_ConstructIP17ServiceProbeMatchS1_EvPT_RKT0_ .gnu.linkonce.t._ZNSt6vectorIP17ServiceProbeMatchSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ .gnu.linkonce.t._ZSt10_ConstructIP12ServiceProbeS1_EvPT_RKT0_ .gnu.linkonce.t._ZNSt6vectorIP12ServiceProbeSaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12ServiceProbeEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12ServiceProbeED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EED2Ev .gnu.linkonce.t._ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE12_Vector_implD1Ev .gnu.linkonce.t._ZNSaIP12ServiceProbeED2Ev .gnu.linkonce.t._ZSt8_DestroyIPP12ServiceProbeEvT_S3_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEC1ERKS3_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP10ServiceNFOEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP10ServiceNFOED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSaISt10_List_nodeIP10ServiceNFOEED2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP10ServiceNFOEED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EE8_M_clearEv .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP10ServiceNFOEC1EPSt15_List_node_base .gnu.linkonce.t._ZNKSt4listIP10ServiceNFOSaIS1_EE5beginEv .gnu.linkonce.t._ZNKSt4listIP10ServiceNFOSaIS1_EE3endEv .gnu.linkonce.t._ZSt8distanceISt20_List_const_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E15difference_typeES5_S5_ .gnu.linkonce.t._ZSt19__iterator_categoryISt14_List_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ .gnu.linkonce.t._ZSt4findISt14_List_iteratorIP10ServiceNFOES2_ET_S4_S4_RKT0_St18input_iterator_tag .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNSt12_Vector_baseItSaItEE12_Vector_implC1ERKS0_ .gnu.linkonce.t._ZNSaItEC2ERKS_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorItEC2ERKS1_ .gnu.linkonce.t._ZNSt12_Vector_baseItSaItEE13_M_deallocateEPtj .gnu.linkonce.t._ZSt13__destroy_auxIPtEvT_S1_11__true_type .gnu.linkonce.t._ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE12_Vector_implC1ERKS2_ .gnu.linkonce.t._ZNSaIP17ServiceProbeMatchEC2ERKS1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchEC2ERKS3_ .gnu.linkonce.t._ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE13_M_deallocateEPS1_j .gnu.linkonce.t._ZSt13__destroy_auxIPP17ServiceProbeMatchEvT_S3_11__true_type .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEdeEv .gnu.linkonce.t._ZNKSt6vectorItSaItEE4sizeEv .gnu.linkonce.t._ZNSt12_Vector_baseItSaItEE11_M_allocateEj .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEppEv .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEEvT_S7_ .gnu.linkonce.t._ZN9__gnu_cxxmiIPtS1_St6vectorItSaItEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS8_RKNS5_IT0_S7_EE .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZNKSt6vectorIP17ServiceProbeMatchSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSt12_Vector_baseIP17ServiceProbeMatchSaIS1_EE11_M_allocateEj .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEppEv .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEEEvT_S9_ .gnu.linkonce.t._ZSt13copy_backwardIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZNKSt6vectorIP12ServiceProbeSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE11_M_allocateEj .gnu.linkonce.t._ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS2_SaIS2_EEEppEv .gnu.linkonce.t._ZSt8_DestroyIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEEEvT_S9_ .gnu.linkonce.t._ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE13_M_deallocateEPS1_j .gnu.linkonce.t._ZNSt12_Vector_baseIP12ServiceProbeSaIS1_EE12_Vector_implC1ERKS2_ .gnu.linkonce.t._ZNSaIP12ServiceProbeEC2ERKS1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12ServiceProbeEC2ERKS3_ .gnu.linkonce.t._ZSt13__destroy_auxIPP12ServiceProbeEvT_S3_11__true_type .gnu.linkonce.t._ZNSaISt10_List_nodeIP10ServiceNFOEEC1IS1_EERKSaIT_E .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EE7_M_initEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEED2Ev .gnu.linkonce.t._ZSt8_DestroyIP10ServiceNFOEvPT_ .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E .gnu.linkonce.t._ZNSt4listIP10ServiceNFOSaIS1_EE14_M_create_nodeERKS1_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP10ServiceNFOEC1EPKSt15_List_node_base .gnu.linkonce.t._ZSt19__iterator_categoryISt20_List_const_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ .gnu.linkonce.t._ZSt10__distanceISt20_List_const_iteratorIP10ServiceNFOEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag .gnu.linkonce.t._ZNSt14_List_iteratorIP10ServiceNFOEppEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorItE10deallocateEPtj .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchE10deallocateEPS2_j .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZNKSt6vectorItSaItEE3endEv .gnu.linkonce.t._ZNKSt6vectorItSaItEE5beginEv .gnu.linkonce.t._ZN9__gnu_cxxmiIPKtS2_St6vectorItSaItEEEENS_17__normal_iteratorIT_T1_E15difference_typeERKS9_RKNS6_IT0_S8_EE .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorItE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEEEvT_S7_11__true_type .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZNKSt6vectorIP17ServiceProbeMatchSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt6vectorIP17ServiceProbeMatchSaIS1_EE5beginEv .gnu.linkonce.t._ZN9__gnu_cxxmiIPKP17ServiceProbeMatchS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP17ServiceProbeMatchE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type .gnu.linkonce.t._ZSt37__copy_backward_input_normal_iteratorIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZNKSt6vectorIP12ServiceProbeSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt6vectorIP12ServiceProbeSaIS1_EE5beginEv .gnu.linkonce.t._ZN9__gnu_cxxmiIPKP12ServiceProbeS4_St6vectorIS2_SaIS2_EEEENS_17__normal_iteratorIT_T1_E15difference_typeERKSB_RKNS8_IT0_SA_EE .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12ServiceProbeE8allocateEjPKv .gnu.linkonce.t._ZSt24__uninitialized_copy_auxIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt13__destroy_auxIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEEEvT_S9_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12ServiceProbeE10deallocateEPS2_j .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEEC2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP10ServiceNFOEEC2ERKS3_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEE10deallocateEPS4_j .gnu.linkonce.t._ZNSt10_List_baseIP10ServiceNFOSaIS1_EE11_M_get_nodeEv .gnu.linkonce.t._ZSt10_ConstructIP10ServiceNFOS1_EvPT_RKT0_ .gnu.linkonce.t._ZNKSt20_List_const_iteratorIP10ServiceNFOEneERKS2_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP10ServiceNFOEppEv .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIPtN9__gnu_cxx17__normal_iteratorIS0_St6vectorItSaItEEEEET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPKtSt6vectorItSaItEEEC1ERKS2_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPKtSt6vectorItSaItEEE4baseEv .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_ .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIPP17ServiceProbeMatchN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPKP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEEC1ERKS4_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPKP17ServiceProbeMatchSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZSt38__copy_backward_output_normal_iteratorIPP12ServiceProbeN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZN9__gnu_cxx17__normal_iteratorIPKP12ServiceProbeSt6vectorIS2_SaIS2_EEEC1ERKS4_ .gnu.linkonce.t._ZNK9__gnu_cxx17__normal_iteratorIPKP12ServiceProbeSt6vectorIS2_SaIS2_EEE4baseEv .gnu.linkonce.t._ZSt4copyIN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEEC2ERKS5_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP10ServiceNFOEE8allocateEjPKv .gnu.linkonce.t._ZSt19__copy_backward_auxIPtS0_ET0_T_S2_S1_ .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPtSt6vectorItSaItEEEES6_ET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZSt19__copy_backward_auxIPP17ServiceProbeMatchS2_ET0_T_S4_S3_ .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPP17ServiceProbeMatchSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt19__copy_backward_auxIPP12ServiceProbeS2_ET0_T_S4_S3_ .gnu.linkonce.t._ZSt10__copy_ni1IN9__gnu_cxx17__normal_iteratorIPP12ServiceProbeSt6vectorIS3_SaIS3_EEEES8_ET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIPtS0_11__true_typeE4copyEPKtS4_S0_ .gnu.linkonce.t._ZSt10__copy_ni2IPtN9__gnu_cxx17__normal_iteratorIS0_St6vectorItSaItEEEEET0_T_S8_S7_11__true_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIPP17ServiceProbeMatchS2_11__true_typeE4copyEPKS1_S6_S2_ .gnu.linkonce.t._ZSt10__copy_ni2IPP17ServiceProbeMatchN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZNSt24__copy_backward_dispatchIPP12ServiceProbeS2_11__true_typeE4copyEPKS1_S6_S2_ .gnu.linkonce.t._ZSt10__copy_ni2IPP12ServiceProbeN9__gnu_cxx17__normal_iteratorIS2_St6vectorIS1_SaIS1_EEEEET0_T_SA_S9_11__true_type .gnu.linkonce.t._ZSt11__copy_aux2ItEPT_S1_S1_S1_11__true_type .gnu.linkonce.t._ZSt11__copy_aux2IP17ServiceProbeMatchEPT_S3_S3_S3_11__true_type .gnu.linkonce.t._ZSt11__copy_aux2IP12ServiceProbeEPT_S3_S3_S3_11__true_type .gnu.linkonce.t._ZSt14__copy_trivialItEPT_PKS0_S3_S1_ .gnu.linkonce.t._ZSt14__copy_trivialIP17ServiceProbeMatchEPT_PKS2_S5_S3_ .gnu.linkonce.t._ZSt14__copy_trivialIP12ServiceProbeEPT_PKS2_S5_S3_ .gnu.linkonce.t._ZN15NmapOutputTable11getCellAddyEjj .gnu.linkonce.t._ZN12dns_server_sC1Ev .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EED1Ev .gnu.linkonce.t._ZNSaIP9request_sEC1Ev .gnu.linkonce.t._ZNSaIP9request_sED1Ev .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNKSt4listIP12dns_server_sSaIS1_EE4sizeEv .gnu.linkonce.t._ZNSt14_List_iteratorIP12dns_server_sEC1Ev .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP12dns_server_sEneERKS2_ .gnu.linkonce.t._ZNSt14_List_iteratorIP12dns_server_sEppEi .gnu.linkonce.t._ZNKSt14_List_iteratorIP12dns_server_sEdeEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE5clearEv .gnu.linkonce.t._ZNKSt4listIP9request_sSaIS1_EE5emptyEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE5frontEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE9pop_frontEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE10push_frontERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP9request_sEC1Ev .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP9request_sEeqERKS2_ .gnu.linkonce.t._ZNSt14_List_iteratorIP9request_sEppEi .gnu.linkonce.t._ZNKSt14_List_iteratorIP9request_sEdeEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE5eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNKSt14_List_iteratorIP12dns_server_sEeqERKS2_ .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE9push_backERKS1_ .gnu.linkonce.t._ZNKSt14_List_iteratorIP9request_sEneERKS2_ .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE6removeERKS1_ .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EE10_List_implD1Ev .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EE10push_frontERKS1_ .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EE10push_frontERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP11host_elem_sEC1Ev .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EE5beginEv .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EE3endEv .gnu.linkonce.t._ZNKSt14_List_iteratorIP11host_elem_sEneERKS2_ .gnu.linkonce.t._ZNSt14_List_iteratorIP11host_elem_sEppEi .gnu.linkonce.t._ZNKSt14_List_iteratorIP11host_elem_sEdeEv .gnu.linkonce.t._ZNKSt4listIP9request_sSaIS1_EE4sizeEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP9request_sEC2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP9request_sED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNKSt4listIP12dns_server_sSaIS1_EE5beginEv .gnu.linkonce.t._ZNKSt4listIP12dns_server_sSaIS1_EE3endEv .gnu.linkonce.t._ZSt8distanceISt20_List_const_iteratorIP12dns_server_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_ .gnu.linkonce.t._ZNSt14_List_iteratorIP12dns_server_sEC1EPSt15_List_node_base .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EE8_M_clearEv .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EE7_M_initEv .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE8_M_eraseESt14_List_iteratorIS1_E .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP9request_sEC1EPSt15_List_node_base .gnu.linkonce.t._ZNSt14_List_iteratorIP9request_sEppEv .gnu.linkonce.t._ZNSaISt10_List_nodeIP9request_sEED2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP9request_sEED1Ev .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EE9_M_insertESt14_List_iteratorIS1_ERKS1_ .gnu.linkonce.t._ZNSt14_List_iteratorIP11host_elem_sEC1EPSt15_List_node_base .gnu.linkonce.t._ZNKSt4listIP9request_sSaIS1_EE5beginEv .gnu.linkonce.t._ZNKSt4listIP9request_sSaIS1_EE3endEv .gnu.linkonce.t._ZSt8distanceISt20_List_const_iteratorIP9request_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_ .gnu.linkonce.t._ZNSaISt10_List_nodeIP9request_sEEC1IS1_EERKSaIT_E .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE .gnu.linkonce.t._ZNSt20_List_const_iteratorIP12dns_server_sEC1EPKSt15_List_node_base .gnu.linkonce.t._ZSt19__iterator_categoryISt20_List_const_iteratorIP12dns_server_sEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ .gnu.linkonce.t._ZSt10__distanceISt20_List_const_iteratorIP12dns_server_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag .gnu.linkonce.t._ZSt8_DestroyIP9request_sEvPT_ .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E .gnu.linkonce.t._ZNSt4listIP9request_sSaIS1_EE14_M_create_nodeERKS1_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEED2Ev .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EE14_M_create_nodeERKS1_ .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EE14_M_create_nodeERKS1_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP9request_sEC1EPKSt15_List_node_base .gnu.linkonce.t._ZSt19__iterator_categoryISt20_List_const_iteratorIP9request_sEENSt15iterator_traitsIT_E17iterator_categoryERKS5_ .gnu.linkonce.t._ZSt10__distanceISt20_List_const_iteratorIP9request_sEENSt15iterator_traitsIT_E15difference_typeES5_S5_St18input_iterator_tag .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEEC2Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP9request_sEEC2ERKS3_ .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EE11_M_put_nodeEPSt10_List_nodeIS1_E .gnu.linkonce.t._ZNKSt20_List_const_iteratorIP12dns_server_sEneERKS2_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP12dns_server_sEppEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEE10deallocateEPS4_j .gnu.linkonce.t._ZNSt10_List_baseIP9request_sSaIS1_EE11_M_get_nodeEv .gnu.linkonce.t._ZSt10_ConstructIP9request_sS1_EvPT_RKT0_ .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EE11_M_get_nodeEv .gnu.linkonce.t._ZSt10_ConstructIP12dns_server_sS1_EvPT_RKT0_ .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EE11_M_get_nodeEv .gnu.linkonce.t._ZSt10_ConstructIP11host_elem_sS1_EvPT_RKT0_ .gnu.linkonce.t._ZNKSt20_List_const_iteratorIP9request_sEneERKS2_ .gnu.linkonce.t._ZNSt20_List_const_iteratorIP9request_sEppEv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEE10deallocateEPS4_j .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEEC2ERKS5_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEE10deallocateEPS4_j .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP9request_sEE8allocateEjPKv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEE8allocateEjPKv .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEE8allocateEjPKv .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EE10_List_implD1Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP12dns_server_sEED2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EE8_M_clearEv .gnu.linkonce.t._ZSt8_DestroyIP12dns_server_sEvPT_ .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EE10_List_implD1Ev .gnu.linkonce.t._ZNSaISt10_List_nodeIP11host_elem_sEED2Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEED2Ev .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EE8_M_clearEv .gnu.linkonce.t._ZSt8_DestroyIP11host_elem_sEvPT_ .gnu.linkonce.t._ZNSaIP11host_elem_sED1Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP11host_elem_sED2Ev .gnu.linkonce.t._ZNSt4listIP11host_elem_sSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EE7_M_initEv .gnu.linkonce.t._ZNSaISt10_List_nodeIP11host_elem_sEED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP11host_elem_sSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE .gnu.linkonce.t._ZNSaISt10_List_nodeIP11host_elem_sEEC2ERKS3_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEEC2ERKS5_ .gnu.linkonce.t._ZNSaISt10_List_nodeIP11host_elem_sEEC1IS1_EERKSaIT_E .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP11host_elem_sEEC2Ev .gnu.linkonce.t._ZNSaIP11host_elem_sEC1Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP11host_elem_sEC2Ev .gnu.linkonce.t._ZNSaIP12dns_server_sED1Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12dns_server_sED2Ev .gnu.linkonce.t._ZNSt4listIP12dns_server_sSaIS1_EEC1ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EEC2ERKS2_ .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EE7_M_initEv .gnu.linkonce.t._ZNSaISt10_List_nodeIP12dns_server_sEED1Ev .gnu.linkonce.t._ZNSt10_List_baseIP12dns_server_sSaIS1_EE10_List_implC1ERKSaISt10_List_nodeIS1_EE .gnu.linkonce.t._ZNSaISt10_List_nodeIP12dns_server_sEEC2ERKS3_ .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEEC2ERKS5_ .gnu.linkonce.t._ZNSaISt10_List_nodeIP12dns_server_sEEC1IS1_EERKSaIT_E .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorISt10_List_nodeIP12dns_server_sEEC2Ev .gnu.linkonce.t._ZNSaIP12dns_server_sEC1Ev .gnu.linkonce.t._ZN9__gnu_cxx13new_allocatorIP12dns_server_sEC2Ev .rodata .got .plt .dynamic .data .ctors .dtors .eh_frame .jcr .data.rel.local .gcc_except_table .bss .symtab .strtab .comment .stab.index .debug_abbrev .debug_info .debug_line .debug_frame .debug_pubnames .debug_aranges .debug_str .shstrtab .stab.indexstr                                                                             	             44                       5  5  h`                     " |  |  H                  o                        -      B     0              7      B     <              A      B                    K         8@                  Q       
4 	4                     W       
P 	P                     ]       
d 	d                     |       
 	   ,                         
@ 	@                            
 	                            
 	                          
  	    8                 J       
8 	8   8                 w       
p 	p   8                        
ܨ 	ܨ   p                        
 	   8                        
P 	P   8                 1       
݈ 	݈                    ^       
ݤ 	ݤ                            
 	   8                        
 	   8                        
4 	4                             
T 	T                    A       
 	   @                 e       
  	    $                        
D 	D   H                        
ߌ 	ߌ   X                        
 	   @                        
$ 	$   @                 +       
d 	d   P                 a       
 	                           
| 	|  P                        
 	                          
L 	L  P                 3       
 	  (                 q       
 	                           
 	   l                        
 	   8                        
0 	0                     Q       
P 	P                            
p 	p   P                        
 	                           
 	   @                 I       
 	   @                 m       
8 	8   `                        
 	   8                        
 	                           
 	  P                 d       
 	                           
x 	x                           
X 	X                    	       
8 	8                    	       
X 	X                    	       
 	                    
0       
 	   p                 
       
L 	L                    
       
 	                    
       
 	                    @       
 	                    t       
 	                           
 	   L                 2       
 	                    ^       
 	   x                        
 	   P                        
 	   (                        
 	   (                 R       
  	                            
 	   `                          
    x                 2         
    P                 {         
    `                        8 
8                    .        
                            
                           h 
h   H                 r        
   X                         
                    ,        
   h                 q         
    h                        h 
h                    ^       H 
H                            
                    a         
    x                         
                    -       P 
P                           	  
	    x                        	 
	   h                 !       
  

                            
 

   x                        X 
X                    B       0 
0                            
   h                        ` 
`                    A         
                     m        
   $                        @ 
@                            
   H                         
   @                 #       T 
T                    N       8 
8   `                 u        
                             
                             
   @                         
   @                        X 
X   P                 6        
                    c       p 
p                           0 
0  (                        X 
X   p                         
                     0        
                     f        
   P                        X 
X                           P 
P   @                         
   @                 3        
   `                 ]       0 
0   p                         
   p                         
                    B        
                    t       0 
0                           !0 
!0   `                 	       ! 
!   P                 :       ! 
!   L                        ", 
",   8                        "d 
"d   x                 $       " 
"   P                 G       #, 
#,   (                        #T 
#T                           # 
#   (                        # 
#   H                 X       $D 
$D   0                        $t 
$t   H                         $ 
$                     o       % 
%   `                         % 
%                    !!       & 
&   0                 !u       & 
&   X                 !       'D 
'D                    "%       ' 
'   P                 "i       ($ 
($                    "       ) 
)   h                 #<       )l 
)l                    #       *, 
*,                    $5       *D 
*D                    $       * 
*                    %-       + 
+   h                 %k       ,4 
,4                    %       - 
-                    &:       - 
-                    &       . 
.   h                 &       / 
/                    '*       / 
/   ,                 'c       / 
/                     '       0 
0   ,                 '       04 
04                     '       0T 
0T                    (       0p 
0p                    (F       0 
0                    (x       1 
1                     (       10 
10   ,                 (       1\ 
1\                    )       1x 
1x   $                 )=       1 
1   `                 )e       1 
1   `                 )       2\ 
2\                    )       3H 
3H   `                 *       3 
3                     *F       3 
3                     *r       3 
3   (                 *       4 
4   X                 *       4h 
4h                     +8       4 
4                    +t       4 
4   `                 +       5  
5                      +       5  
5                      ,       5@ 
5@   (                 ,;       5h 
5h   X                 ,w       5 
5                     ,       5 
5                     ,       6  
6                      -       6  
6    (                 -C       6H 
6H   d                 -w       6 
6                     -       6 
6                     -       6 
6   (                 -       7 
7   d                 .       7x 
7x                    .@       7 
7   ,                 .y       7 
7   (                 .       7 
7   4                 .       8 
8   <                 /'       8T 
8T   d                 /`       8 
8                     /       8 
8   ,                 /       9 
9   @                 0       9D 
9D   @                 0S       9 
9                     0       9 
9   <                 0       9 
9   (                 1       : 
:   4                 1G       :< 
:<   ,                 1       :h 
:h                   1       << 
<<   H                 1       < 
<   4                 2-       < 
<   L                 2       = 
=   ,                 2       =0 
=0   L                 3       =| 
=|   l                 3?       = 
=   8                 3z       >  
>    0                 3       >P 
>P   (                 3       >x 
>x   `                 4S       > 
>   0                 4~       ? 
?   `                 4       ?h 
?h   L                 5       ? 
?   `                 5?       @ 
@                    5       A  
A   h                 5       Bh 
Bh                    6       B 
B   H                 6\       CD 
CD   <                 6       C 
C   l                 6       C 
C   8                 6       D$ 
D$                    7F       D< 
D<   L                 7       D 
D   H                 8        D 
D   ,                 8:       D 
D   (                 8r       E$ 
E$   d                 8       E 
E                    9,       E 
E                    9o       E 
E                    9       F` 
F`                     9       F 
F                     :*       F 
F   p                 :p       G 
G   ,                 :       G< 
G<   (                 :       Gd 
Gd   d                 ;b       G 
G                    ;       G 
G                    ;       G 
G                    <"       H 
H                     <[       H 
H                     <       H 
H   p                 <       IP 
IP                    =       I` 
I`                    =Q       Ip 
Ip   (                 =       I 
I                    =       J< 
J<                     >       J\ 
J\                     >:       J| 
J|   0                 >k       J 
J                    >       J 
J                    >       J 
J   (                 ?       J 
J   x                 ?7       Kl 
Kl                     ?u       K 
K                     ?       K 
K   0                 ?       K 
K                     @       K 
K   8                 @?       L4 
L4   8                 @v       Ll 
Ll   L                 @       L 
L   P                 A3       M 
M                     A       M( 
M(   D                 A       Ml 
Ml   P                 B/       M 
M   X                 B       N 
N                    B       N0 
N0                    C       N@ 
N@   $                 Cj       Nd 
Nd   `                 C       N 
N   $                 D>       N 
N   p                 D       OX 
OX   P                 E>       O 
O   8                 Ej       O 
O   8                 E       P 
P   D                 F       P\ 
P\   h                 F       P 
P   H                 F       Q 
Q   p                 Gp       Q| 
Q|                    G       Q 
Q   l                 G       R 
R                    H>       R 
R   @                 H       R 
R   `                 H       SL 
SL  T                 I0       W 
W   D                 I       W 
W   H                 I       X, 
X,                    J        XH 
XH                    JE       XX 
XX                     J       Xx 
Xx                    K       X 
X   d                 K       X 
X   $                 K       Y 
Y   (                 LW       Y@ 
Y@   (                 L       Yh 
Yh                    L       Yx 
Yx                    M#       Y 
Y   ,                 M       Y 
Y                     M       Y 
Y                    N]       Y 
Y   d                 N       ZP 
ZP   $                 O5       Zt 
Zt   (                 O       Z 
Z   (                 O       Z 
Z                    P'       Z 
Z                    PX       Z 
Z   ,                 P       [ 
[   <                 P       [L 
[L   (                 Q)       [t 
[t                    Qj       [ 
[   H                 Q       [ 
[   <                 Q       \ 
\   (                 R       \4 
\4                    RI       \H 
\H   @                 R       \ 
\                    R       \ 
\   $                 S       \ 
\                    S{       \ 
\                    S       ]p 
]p                   TR       c 
c  <                 T       i, 
i,   $                 U       iP 
iP                    UP       ih 
ih   p                 U       i 
i   h                 VJ       j@ 
j@                    V       jX 
jX   0                 V       j 
j   <                 W/       j 
j   (                 Wz       j 
j   h                 W       kT 
kT   h                 Xi       k 
k   ,                 X       k 
k                    Y       l 
l   4                 YK       l 
l   ,                 Y       l 
l                    Y       l 
l   (                 Z       m 
m   (                 Z~       m@ 
m@   4                 Z       mt 
mt   ,                 [       m 
m                    [W       m 
m   (                 [       m 
m   (                 [       n  
n    (                 \2       n( 
n(   ,                 \|       nT 
nT   H                 \       n 
n   L                 ]"       n 
n   d                 ]       oL 
oL   H                 ^       o 
o   T                 ^       o 
o   L                 ^       p4 
p4   D                 _7       px 
px   <                 _r       p 
p   h                 _       q 
q   H                 `'       qd 
qd   l                 `       q 
q   <                 `       r 
r   T                 a.       r` 
r`   0                 ai       r 
r   (                 a       r 
r   h                 b       s  
s    P                 bs       sp 
sp   H                 b       s 
s                    c       s 
s   d                 c       t4 
t4   @                 c       tt 
tt   l                 d9       t 
t   p                 d       uP 
uP                    ea       u 
u   ,                 e       v  
v    H                 e       vh 
vh                    f;       v| 
v|                    f       v 
v   @                 f       v 
v                    g       v 
v   ,                 h<       w 
w   4                 h       wH 
wH                    iR       w 
w   4                 i       x 
x   p                 j-       xx 
xx   L                 j       x 
x   ,                 j       x 
x   4                 k"       y$ 
y$   L                 k       yp 
yp   ,                 k       y 
y   `                 l`       y 
y   H                 l       zD 
zD                    mP       zP 
zP   T                 m       z 
z   \                 n6       {  
{    @                 n       {@ 
{@   H                 n       { 
{   <                 o       { 
{   \                 o       |  
|    H                 o       |h 
|h   P                 o       | 
|   T                 pK       } 
}   h                 p       }t 
}t                    q
       } 
}                    qr       ~ 
~                    q       ~ 
~   4                 r       ~ 
~   <                 rM       4 
4   4                 r       h 
h   \                 r        
   p                 sm       4 
4   T                 s        
   <                 t        
   X                 t^        
   d                 t        
                    u/       8 
8   4                 um       l 
l   P                 u        
   ,                 u        
                    u        
   (                 v'       , 
,   l                 v]        
                    v        
                    v        
                     v        
   0                 w!         
                      wS       @ 
@   8                 w       x 
x   X                 w        
                     w        
                     w        
   (                 x       8 
8   d                 x;        
                     xk        
                     x        
   (                 x        
   d                 y       h 
h                    y|        
   (                 y        
   0                 y        
   L                 zo       $ 
$   H                 z       l 
l                    {2        
                    {e        
   (                 {       D 
D   0                 {       t 
t   t                 |        
   L                 |u       4 
4                    |       L 
L   L                 }%        
   H                 }u        
                    }       t 
t                    ~        
                     ~/       ( 
(                     ~Z       H 
H   (                 ~       p 
p   d                 ~        
                    ,        
   (                 i        
   0                        D 
D   L                         
   H                 l        
                            
                             
                            4 
4   (                 T       \ 
\   X                         
                             
   H                         
                    R       4 
4   ,                        ` 
`   (                         
   4                          
   <                 9        
                     s        
   `                        x 
x   t                         
   L                 H       8 
8   ,                        d 
d   @                         
   @                         
                    ,        
                    `        
   (                        , 
,   |                         
                             
                             
   0                 G        
                           ( 
(                           8 
8   (                        ` 
`   |                 c        
                             
                             
   0                 !       L 
L   $                        p 
p                            
   H                         
                    w        
   $                         
                    V        
  \                        h 
h                             
   H                 c        
                            
   H                         
                            
                             
                            0 
0   (                 R       X 
X   |                         
                             
                             
   0                 A       D 
D   $                        h 
h                            
                    A        
                            
                           X 
X                            x 
x                     3        
   p                 v        
   D                        L 
L                            l 
l   ,                 T        
   (                         
   d                        $ 
$                           < 
<                            
   P                 6         
    <                 x       \ 
\   (                         
                            
   @                         
                    J        
   <                        ( 
(   (                        P 
P                            d 
d   @                 v        
                            
   h                 ,         
                     w       < 
<   `                         
   0                         
   h                 L       4 
4   ,                        ` 
`   H                         
   H                 l        
   h                        X 
X   `                 -        
   0                 }        
   h                        P 
P   ,                 b       | 
|   H                         
   h                 M       , 
,   `                         
   0                         
   h                 T       $ 
$   ,                        P 
P   H                         
   @                 m        
   <                         
   (                        < 
<                    4       P 
P                    }       d 
d   $                         
   (                 "        
   (                 d        
                            
                            
   ,                 ?       $ 
$                            
                             
                    ]        
   d                        X 
X   ,                 &        
   (                 f        
   (                         
   p                 H       D 
D   8                 t       | 
|   8                         
   H                         
   4                 ]       0 
0   `                         
                    J        
   p                         
   8                 /       D 
D   8                 r       | 
|   H                         
   4                 W        
   `                        X 
X                    r       d 
d   p                         
   8                 M        
   8                        D 
D   H                         
   4                 f        
   `                          
                     w       , 
,   (                        T 
T                           d 
d   (                 T        
   (                         
   ,                         
   H                 5       ( 
(   4                 y       \ 
\   ,                         
   \                 F        
   $                         
                             
    h                 B        
   \                         
   $                 M        
                             
    h                 (        
   \                         
   $                 )        
                             
    h                         
                    N        
   @                         
   4                         
   p                 V        
   4                         
   p                 .       $ 
$   4                 x       X 
X   p                         
   l                 O       4 
4   d                         
   l                 )        
   d                        h 
h   l                         
   d                        8 
8   4                        l 
l   4                 (         
    4                 t        
   P                        $ 
$   P                        t 
t   P                 7        
                    l       Ĥ 
Ĥ                          ż 
ż                             
                             
                             
   (                 J       D 
D   `                        Ƥ 
Ƥ                           Ƽ 
Ƽ   ,                         
   (                 4        
   4                 t       D 
D   <                        ǀ 
ǀ                            Ǡ 
Ǡ   ,                 "        
   ,                 Z        
   @                        8 
8   @                        x 
x   H                         
                    D        
   ,                 {        
   (                        , 
,   4                        ` 
`   <                 #       ɜ 
ɜ                     [       ɼ 
ɼ   L                         
   4                        < 
<   H                 '       ʄ 
ʄ   4                 c       ʸ 
ʸ                           ˘ 
˘   X                         
                             
   H                 d       X 
X   H                        ̠ 
̠                           ̸ 
̸   ,                         
   (                 T        
   4                        @ 
@   <                        | 
|                            ͜ 
͜   `                 ?        
                    }        
                    û        
                            
   ,                 5         
    (                 o       ( 
(   d                        ό 
ό                     6       Ϭ 
Ϭ   p                 w        
   (                 ŷ       D 
D   P                        Д 
Д   D                 ]        
                     Ƨ        
   ,                        $ 
$                            D 
D                     L       d 
d   D                 Ǧ       Ѩ 
Ѩ   D                         
                     L        
   ,                 Ȅ       8 
8   (                 Ⱥ       ` 
`   d                 /        
   $                 r        
   (                         
                     %       0 
0                    ʫ       H 
H   d                 =       Ӭ 
Ӭ                    l       Ӽ 
Ӽ   ,                         
                    	       Ԁ 
Ԁ                    W       Ԑ 
Ԑ                    ̠       ( 
(                            
                     9        
                    ͻ        
   d                 I       \ 
\   ,                 Υ       ֈ 
ֈ                           ֘ 
֘   (                 .        
   ,                 ω        
   4                          
    ,                        L 
L   (                 l       t 
t   ,                 б       נ 
נ   H                         
   ,                 4        
   H                 r       \ 
\   ,                 Ѻ       ؈ 
؈   H                         
   4                 9        
   ,                 v       0 
0   (                        X 
X                    (       l 
l   (                 Ӈ       ٔ 
ٔ   @                         
   @                 ;        
   @                 Ԗ       T 
T                            t 
t   X                         
                     U        
                     Ր        
                            
   p                 '       ی 
ی                    Z       ۜ 
ۜ                     ֐       ۼ 
ۼ   X                         
                            4 
4                     P       T 
T                    ס       d 
d   p                         
                            
                     A        
                    ؂        
   (                 ؼ       < 
<   \                        ݘ 
ݘ   (                 @        
                     z        
   (                         
   (                        0 
0                    n       D 
D   $                 ڴ       h 
h                           x 
x                     /       ޘ 
ޘ                    p       ި 
ި                     ۛ        
                            
   (                          
    \                 Z       \ 
\   (                 ܞ       ߄ 
߄                            ߤ 
ߤ   (                 ;        
   (                 z        
                            
   $                        , 
,                    i       < 
<                     ޔ       \ 
\                           p 
p A                            ,                          	(                                                   |                        
 
                           
 
                           
 
  o                        z z                           z z                    $       z z  `                 6          ,                 K                               `                                n                               z            -                   ߆                ,                 ߓ            ,                     ߣ            L                     ߲            l                    ߽            y                 07070100243fde000041ed0000000a0000000a0000000344fe8f2800000000000000880000000a00000000000000000000000a00000005reloc/doc 07070100243fdf000041ed0000000a0000000a0000000344fe8f2800000000000000880000000a00000000000000000000000f00000005reloc/doc/nmap    07070100243fe0000081a40000000a0000000a0000000144fe8f260002ee07000000880000000a00000000000000000000001900000005reloc/doc/nmap/CHANGELOG  # Nmap Changelog ($Id: CHANGELOG 3575 2006-06-24 04:13:43Z fyodor $); -*-text-*-
Nmap 4.11

o Added a dozens of more detailed SSH version detection signatures, thanks
  to a SSH huge survey and integration effort by Doug Hoyte.  The
  results of his large-scale SSH scan are posted at 
  http://seclists.org/nmap-dev/2006/Apr-Jun/0393.html .

o Fixed the Nmap Makefile (actually Makefile.in) to correctly handle
  include file dependencies.  So if a .h file is changed, all of the
  .cc files which depend on it will be recompiled.  Thanks to Diman
  Todorov (diman(a)xover.mud.at) for the patch.

o Fixed a compilation problem on solaris and possibly other platforms.
  The error message looked like "No rule to make target `inet_aton.o',
  needed by `libnbase.a'".  Thanks to Matt Selsky
  (selsky(a)columbia.edu) for the patch.

o Applied a patch which helps with HP-UX compilation by linking in the
  nm library (-lnm).  Thanks to Zakharov Mikhail
  (zmey20000(a)yahoo.com) for the patch.

o Added version detection probes for detecting the Nessus daemon.
  Thanks to Adam Vartanian (flooey(a)gmail.com) for sending the patch.

Nmap 4.10

o Updated nmap-mac-prefixes to reflect the latest OUI DB from the IEEE
  (http://standards.ieee.org/regauth/oui/oui.txt) as of May 31, 2006.
  Also added a couple unregistered OUI's (for QEMU and Bochs)
  suggested by Robert Millan (rmh(a)aybabtu.com).

o Fixed a bug which could cause false "open" ports when doing a UDP
  scan of localhost. This usually only happened when you scan tens of
  thousands of ports (e.g. -p- option).

o Fixed a bug in service detection which could lead to a crash when
  "--version-intensity 0" was used with a UDP scan.  Thanks to Makoto
  Shiotsuki (shio(a)st.rim.or.jp) for reporting the problem and Doug
  Hoyte for producing a patch.

o Made some AIX and HP-UX portability fixes to Libdnet and NmapFE.
  These were sent in by Peter O'Gorman
  (nmap-dev(a)mlists.thewrittenword.com).

o When you do a UDP+TCP scan, the TCP ports are now shown first (in
  numerical order), followed by the UDP ports (also in order).  This
  contrasts with the old format which showed all ports together in
  numerical order, regardless of protocol.  This was at first a "bug",
  but then I started thinking this behavior may be better.  If you
  have a preference for one format or the other, please post your
  reasons to nmap-dev.

o Changed mass_dns system to print a warning if it can't find any
  available DNS servers, but not quit like it used to.  Thanks to Doug
  Hoyte for the patch.

Nmap 4.04BETA1

o Integrated all of your submissions (about a thousand) from the first
  quarter of this year!  Please keep 'em coming!  The DB has increased
  from 3,153 signatures representing 381 protocols in 4.03 to 3,441
  signatures representing 401 protocols.  No other tool comes close!
  Many of the already existing match lines were improved too.  Thanks
  to Version Detection Czar Doug Hoyte for doing this.

o Nmap now allows multiple ignored port states.  If a 65K-port scan
  had, 64K filtered ports, 1K closed ports, and a few dozen open
  ports, Nmap used to list the dozen open ones among a thousand lines
  of closed ports.  Now Nmap will give reports like "Not shown: 64330
  filtered ports, 1000 closed ports" or "All 2051 scanned ports on
  192.168.0.69 are closed (1051) or filtered (1000)", and omit all of
  those ports from the table.  Open ports are never ignored.  XML
  output can now have multiple <extraports> directive (one for each
  ignored state).  The number of ports in a single state before it is
  consolidated defaults to 26 or more, though that number increases as
  you add -v or -d options.  With -d3 or higher, no ports will be
  consolidated.  The XML output should probably be augmented to give
  the extraports directive 'ip', 'tcp', and 'udp' attributes which
  specify the corresponding port numbers in the given state in the
  same listing format as the nmaprun.scaninfo.services attribute, but
  that part hasn't yet been implemented.  If you absoultely need the
  exact port numbers for each state in the XML, use -d3 for now.

o Nmap now ignores certain ICMP error message rate limiting (rather
  than slowing down to accomidate it) in cases such as SYN scan where
  an ICMP message and no response mean the same thing (port filtered).
  This is currently only done at timing level Aggressive (-T4) or
  higher, though we may make it the default if we don't hear problems
  with it.  In addition, the --defeat-rst-ratelimit option has been
  added, which causes Nmap not to slow down to accomidate RST rate
  limits when encountered.  For a SYN scan, this may cause closed
  ports to be labeled 'filtered' becuase Nmap refused to slow down
  enough to correspond to the rate limiting.  Learn more about this
  new option at http://www.insecure.org/nmap/man/ .  Thanks to Martin
  Macok (martin.macok(a)underground.cz) for writing the patch that
  these changes were based on.

o Moved my Nmap development environment to Visual C++ 2005 Express
  edition.  In typical "MS Upgrade Treadmill" fashion, Visual Studio
  2003 users will no longer be able to compile Nmap using the new
  solution files.  The compilation, installation, and execution
  instructions at
  http://www.insecure.org/nmap/install/inst-windows.html have been
  upgraded.  

o Automated my Windows build system so that I just have to type a
  single make command in the mswin32 directory.  Thanks to Scott
  Worley (smw(a)pobox.com>, Shane & Jenny Walters
  (yfisaqt(a)waltersinamerica.com), and Alex Prinsier
  (aphexer(a)mailhaven.com) for reading my appeal in the 4.03
  CHANGELOG and assisting.

o Changed the PortList class to use much more efficient data
  structures and algorithms which take advantage of Nmap-specific
  behavior patterns.  Thanks to Marek Majkowski
  (majek(a)forest.one.pl) for the patch.

o Fixed a bug which prevented certain TCP+UDP scan commands, such as
  "nmap -sSU -p1-65535 localhost" from scanning both TCP and UDP.
  Instead they gave the error message "WARNING: UDP scan was requested,
  but no udp ports were specified.  Skipping this scan type".  Thanks to
  Doug Hoyte for the patch.

o Nmap has traditionally required you to specify -T* timing options
  before any more granular options like --max-rtt-timeout, otherwise the
  general timing option would overwrite the value from your more
  specific request.  This has now been fixed so that the more specific
  options always have precendence.  Thanks to Doug Hoyte for this patch.

o Fixed a couple possible memory leaks reported by Ted Kremenek
 (kremenek(a)cs.stanford.edu) from the Stanford University sofware
 static analysis lab ("Checker" project).

o Nmap now prints a warning when you specify a target name which
  resolves to multiple IP addresses.  Nmap proceeds to scan only the
  first of those addresses (as it always has done).  Thanks to Doug
  Hoyte for the patch.  The warning looks like this:
  Warning: Hostname google.com resolves to 3 IPs. Using 66.102.7.99.

o Disallow --host-timeout values of less than 1500ms, print a warning
  for values less than 15s.

o Changed all instances of inet_aton() into calls to inet_pton()
  instead.  This allowed us to remove inet_aton.c from nbase.  Thanks to
  KX (kxmail(a)gmail.com) for the patch.

o When debugging (-d) is specified, Nmap now prints a report on the
  timing variables in use.  Thanks to Doug Hoyte for the patch.  The
  report loos like this:
  ---------- Timing report ----------
    hostgroups: min 1, max 100000
    rtt-timeouts: init 250, min 50, max 300
    scan-delay: TCP 5, UDP 1000
    parallelism: min 0, max 0
    max-retries: 2, host-timeout 900000
  -----------------------------------

o Modified the WinPcap installer file to explicitly uninstall an
  existing WinPcap (if you select that you wish to replace it) rather
  than just overwriting the old version.  Thanks to Doug Hoyte for
  making this change.

o Added some P2P application ports to the nmap-services file.  Thanks
  to Martin Macok for the patch.

o The write buffer length increased in 4.03 was increased even further
  when the debugging or verbosity levels are more than 2 (e.g. -d3).
  Thanks to Brandon Enright (bmenrigh(a)ucsd.edu) for the patch.  The
  goal is to prevent you from ever seeing the fatal error:
  "log_vwrite: write buffer not large enough -- need to increase"

o Added a note to the Nmap configure dragon that people sick of him
  can submit their own ASCII art to nmap-dev@insecure.org .  If you
  are wondering WTF I am talking about, it is probably because only
  most elite Nmap users -- the ones who compile from source on UNIX --
  get to see the 'l33t ASCII Art.

Nmap 4.03

o Updated the LibPCRE build system to add the -fno-thread-jumps option
  to gcc when compiling on the new Intel-based Apple Mac OS X systems.
  Hopefully this resolves the version detection crashes that several
  people have reported on such systems.  Thanks to Kurt Grutzmacher
  (grutz(a)jingojango.net) for sending the configure.ac patch.

o Made some portability fixes to keep Nmap compiling with the newest
  Visual Studio 2005.  Thanks to KX (kxmail(a)gmail.com) for
  suggesting them.

o Service fingerprints are now provided in the XML output whenever
  they would appear in the interactive output (i.e. when a service
  response with data but is unrecognized).  They are shown in a new
  'servicefp' attribute to the 'service' tag.  Thanks to Brandon Enright
  (bmenrigh(a)ucsd.edu) for sending the patch.

o Improved the Windows build system -- mswin32/Makefile now takes care
  of packaging Nmap and creating the installers once Visual Studio (GUI)
  is done building the Release version of mswin32/nmap.sln.  If someone
  knows how to do this (build) step on the command line (using the
  Makefile), please let me know.  Or if you know how to at least make
  'Release' (rather than Debug) the default configuration, that would be
  valuable.

o WinPcap 3.1 binaries are now shipped in the Nmap tarball, along with
  a customized installer written by Doug Hoyte.  That new WinPcap
  installer is now used by the Nmap self-installer (if you request
  WinPcap installation).  Some Nmap users were uncomfortable with a
  "phone home" feature of the official WinPcap installer.  It connects
  back to CACE Technologies, ostensibly to display news and (more
  recently) advertisements.  Our new installer omits that feature, but
  should be otherwise perfectly compatible with WinPcap 3.1.

o Fixed (I hope) a problem where aggressive --min-parallelization
  option values could cause Nmap to quit with the message "box(300, 100,
  15) called (min,max,num)".  Thanks to  Richard van den Berg
  (richard.vandenberg(a)ins.com) for reporting the problem.

o Fixed a rare crash bug thanks to a report and patch from Ganga
  Bhavani (GBhavani(a)everdreamcorp.com)

o Increased a write buffer length to keep Nmap from quitting with the
  message "log_vwrite: write buffer not large enough -- need to
  increase".  Thanks to Dave (dmarcher(a)pobox.com) for reporting the
  issue.

Nmap 4.02ALPHA2

o Updated to a newer XSL stylesheet (for XML to HTML output
  transformation) by Benjamin Erb.  This new version includes IP
  address sorting, removal of javascript requirements, some new
  address, hostname, and Nmap version information, and various minor
  tweaks and fixes.

o Cleaned up the Amiga port code to use atexit() rather than the
  previous macro hack.  Thanks to Kris Katterjohn (kjak(a)ispwest.com)
  for the patch.  Applied maybe half a dozen new other code cleanup
  patches from him as well.

o Made some changes to various Nmap initialization functions which
  help ALT Linux (altlinux.org) and Owl (openwall.com) developers run
  Nmap in a chroot environment.  Thanks to Dmitry V. Levin
  (ldv(a)altlinux.org) for the patch.

o Cleaned up the code a bit by making a bunch (nearly 100) global
  symbols (mostly function calls) static.  I was also able to removed
  some unused functions and superfluous config.h.in defines.  Thanks
  to Dmitry V. Levin (ldv(a)altlinux.org) for sending a list of
  candidate symbols.

o Nmap now tests for the existence of data files using stat(2) rather
  than testing whether they can be opened for reading (with fopen).
  This is because some device files (tape drives, etc.) may react badly
  to being opened at all.  Thanks to Dmitry V. Levin
  (ldv(a)altlinux.org) for the suggestion.

o Changed Nmap to cache interface information rather than opening and
  closing it (with dnet's eth_open and eth_close functions) all the
  time.

o Applied a one-character Visual Studio 2005 compatibility patch from
  kx (kxmail(a)gmail.com).  It changed getch() into _getch() on Windows.

Nmap 4.02ALPHA1

o Added the --log-errors option, which causes most warnings and error
  messages that are printed to interactive-mode output (stdout/stderr)
  to also be printed to the normal-format output file (if you
  specified one).  This will not work for most errors related to bad
  command-line arguments, as Nmap may not have initialized its output
  files yet.  In addition, some Nmap error/warning messages use a
  different system that does not yet support this option.

o Rewrote much of the Nmap results output functions to be more
  efficient and support --log-errors.

o Fixed a flaw in the scan engine which could (in rare cases)
  lead to a deadlock situation that prevents a scan from completing.
  Thanks to Ganga Bhavani (GBhavani(a)everdreamcorp.com) for reporting
  and helping to debug the problem.

o If the pcap_open_live() call (initiates sniffing) fails, Nmap now
  tries up to two more times after waiting a little while. This is
  attempt to work around a rare bug on Windows in which the
  pcap_open_live() fails for unknown reasons.

o Fixed a flaw in the runtime interaction in which Nmap would include
  hosts currently being scanned in the number of hosts "completed"
  statistic.

o Fixed a crash in OS scan which could occur on Windows when a DHCP
  lease issue causes the system to lose its IP address.  Nmap still
  quits, but at least it gives a proper error message now.  Thanks to
  Ganga Bhavani (GBhavani(a)everdreamcorp.com) for the patch.

o Applied more than half a dozen small code cleanup patches from
  Kris Katterjohn (kjak(a)ispwest.com).

o Modified the configure script to accept CXX when specified as an
  absolute path rather than just the executable name.  Thanks to
  Daniel Roethlisberger (daniel(a)roe.ch) for this patch.

Nmap 4.01

o Fixed a bug that would cause bogus reverse-DNS resolution on
  big-endian machines.  Thanks to Doug Hoyte, Seth Miller, Tony Doan,
  and Andrew Lutomirsky for helping to debug and patch the problem.

o Fixed an important memory leak in the raw ethernet sending system.
  Thanks to Ganga Bhavani (GBhavani(a)everdreamcorp.com) for
  identifying the bug and sending a patch.

o Fixed --system-dns option so that --system_dns works too.  Error
  messages were changed to reflect the former (preferred) name.
  Thanks to Sean Swift (sean.swift(a)bradford.gov.uk) and Peter
  VanEeckhoutte (Peter.VanEeckhoutte(a)saraleefoodseurope.com) for
  reporting the problem.

o Fixed a crash which would report this message:
  "NmapOutputTable.cc:143: void NmapOutputTable::addItem(unsigned int,
  unsigned int, bool, const char*, int): Assertion `row < numRows'
  failed."  Thanks to Jake Schneider (Jake.Schneider(a)dynetics.com) for
  reporting and helping to debug the problem.

o Whenever Nmap sends packets with the SYN bit set (except for OS
  detection), it now includes the maximum segment size (MSS) tcp
  option with a value of 1460.  This makes it stand out less as almost
  all hosts set at least this option.  Thanks to Juergen Schmidt
  (ju(a)heisec.de) for the suggestion.

o Applied a patch for a Windows interface reading bug in the aDNS
  subsystem from Doug Hoyte.

o Minor changes to recognize DragonFly BSD in configure
  scripts. Thanks to Joerg Sonnenberger (joerg(a)britannica.bec.de)
  for sending the patch.

o Fixed a minor bug in an error message starting with "eth_send of ARP
  packet returned".  Thanks to J.W. Hoogervorst
  (J.W.Hoogervorst(a)uva.nl) for finding this.

Nmap 4.00

o Added the '?' command to the runtime interaction system.  It prints a
  list of accepted commands.  Thanks to Andrew Lutomirski
  (luto(a)myrealbox.com) for the patch.

o See the announcement at
  http://www.insecure.org/stf/Nmap-4.00-Release.html for high-level
  changes since 3.50.

Nmap 3.9999

o Generated a new libpcre/configure to cope with changes in LibPCRE
  6.4

o Updated nmap-mac-prefixes to reflect the latest OUI DB from the IEEE
  (http://standards.ieee.org/regauth/oui/oui.txt)

o Updated nmap-protocols with the latest IEEE internet protocols
  assignments (http://www.iana.org/assignments/protocol-numbers).

o Updated the Nmap version number and related fields that MS Visual
  Studio places in the binary.  This was done by editing
  mswin32/nmap.rc.

Nmap 3.999

o Added runtime interaction support to Windows, thanks to patches from
  Andrew Lutomirski (luto(a)myrealbox.com) and Gisle Vanem (giva(a)bgnett.no).

o Changed a couple lines of tcpip.cc (put certain IP header fields in
  host byte order rather than NBO) to (hopefully) support Mac OS X on
  Intel.  Thanks to Kurt Grutzmacher (grutz(a)jingojango.net) for the
  patch.

o Upgraded the included LibPCRE from version 6.3 to 6.4.  There was a
  report of version detection crashes on the new Intel-based MACs with
  6.3.

o Fixed an issue in which the installer would malfunction in rare
  issues when installing to a directory with spaces in it.  Thanks to
  Thierry Zoller (Thierry(a)Zoller.lu) for the report.

Nmap 3.99

o Integrated all remaining 2005 service submissions.  The DB now has
  surpassed 3,000 signatures for the first time.  There now are 3,153
  signatures for 381 service protocols.  Those protocols span the
  gamut from abc, acap, afp, and afs to zebedee, zebra, and
  zenimaging.  It even covers obscure protocols such as http, ftp,
  smtp, and ssh :).  Thanks to Version Detection Czar Doug Hoyte for
  his excellent work on this.

o Created a Windows executable installer using the open source NSIS
  (Nullsoft Scriptable Install System).  It handles Pcap installation,
  registry performance changes, and adding Nmap to your cmd.exe
  executable path.  The installer source files are in mswin32/nsis/ .
  Thanks to Google SoC student Bo Jiang (jiangbo(a)brandeis.edu) for
  creating the initial version.

o Fixed a backward compatibility bug in which Nmap didn't recognize
  the --min_rtt_timeout option (it only recognized the newly
  hyphenated --min-rtt-timeout).  Thanks to Joshua D. Abraham
  (jabra(a)ccs.neu.edu) for the bug report.

o Fixed compilation to again work with gcc-derivatives such as
  MingW. Thanks to Gisle Vanem (giva(a)bgnett.no) for sending the
  patches

Nmap 3.98BETA1

o Added run time interaction as documented at
  http://www.insecure.org/nmap/man/man-runtime-interaction.html .
  While Nmap is running, you can now press 'v' to increase verbosity,
  'd' to increase the debugging level, 'p' to enable packet tracing,
  or the capital versions (V,D,P) to do the opposite.  Any other key
  (such as enter) will print out a status message giving the estimated
  time until scan completion.  This only works on UNIX for now.  Do we
  have any volunteers to add Windows support?  You would need to
  change a handful of UNIX-specific termio calls with the Windows
  equivalents.  This feature was created by Paul Tarjan
  (ptarjan(a)stanford.edu) as part of the Google Summer of Code.

o Reverse DNS resolution is now done in parallel rather than one at a
  time.  All scans of large networks (particularly list, ping and
  just-a-few-ports scans) should benefit substantially from this
  change.  If you encounter any problems, please let us know.  The new
  --system_dns option was added so you can use the (slow) system
  resolver if you prefer that for some reason.  You can specify a
  comma separated list of DNS server IP addresses for Nmap to use with
  the new --dns_servers option.  Otherwise, Nmap looks in
  /etc/resolve.conf (UNIX) or the system registry (Windows) to obtain
  the nameservers already configured for your system.  This excellent
  patch was written by Doug Hoyte (doug(a)hcsw.org).

o Added the --badsum option, which causes Nmap to use invalid TCP or
  UDP checksums for packets sent to target hosts. Since virtually all
  host IP stacks properly drop these packets, any responses received
  are likely coming from a firewall or IDS that didn't bother to
  verify the checksum. For more details on this technique, see
  http://www.phrack.org/phrack/60/p60-0x0c.txt .  The author of that
  paper, Ed3f (ed3f(a)antifork.org), is also the author of this patch
  (which I changed it a bit).

o The 26 Nmap commands that previously included an underscore
  (--max_rtt_timeout, --send_eth, --host_timeout, etc.) have been
  renamed to use a hyphen in the preferred format
  (i.e. --max-rtt-timeout).  Underscores are still supported for
  backward compatibility.

o More excellent NmapFE patches from Priit Laes (amd(a)store20.com)
  were applied to remove all deprecated GTK API calls.  This also
  eliminates the annoying Gtk-Critical and Gtk-WARNING runtime messages.

o Changed the way the __attribute__ compiler extension is detected so
  that it works with the latest Fedora Core 4 updates (and perhaps other
  systems).  Thanks to Duilio Protti (dprotti(a)fceia.unr.edu.ar) for
  writing the patch.  The compilation error message this fixes was
  usually something like: "nmap.o(.rodata+0x17c): undefined reference
  to `__gthrw_pthread_cancel(unsigned long)"

o Added some exception handling code to mswin32/winfix.cc to prevent
  Nmap from crashing mysteriously when you have WinPcap 3.0 or earlier
  (instead of the required 3.1).  It now prints an error message instead
  asking you to upgrade, then reduces functionality to connect()-only
  mode.  I couldn't get it working with the C++ standard try/catch()
  blocks, but as soon as I used the nonstandard MS conventions
  (__try/__except(), everything worked fine. Shrug.

o Stripped the firewall API out of the libdnet included with Nmap
  because Nmap doesn't use it anyway.  This saves space and reduces the
  likelihood of compilation errors and warnings.

o Modified the previously useless --noninteractive option so that it
  deactivates runtime interaction.

Nmap 3.96BETA1

o Added --max_retries option for capping the maximum number of
  retransmissions the port scan engine will do. The value may be as low
  as 0 (no retransmits).  A low value can increase speed, though at the
  risk of losing accuracy.  The -T4 option now allows up to 6 retries,
  and -T5 allows 2.  Thanks to Martin Macok
  (martin.macok(a)underground.cz) for writing the initial patch, which I
  changed quite a bit.  I also updated the docs to reflect this neat
  new option.

o Many of the Nmap low-level timing options take a value in
  milliseconds.  You can now append an 's', 'm', or 'h' to the value
  to give it in seconds, minutes, or hours instead.  So you can specify a
  45 minute host timeout with --host_timeout 45m rather than specifying
  --host_timeout 2700000 and hoping you did the math right and have the 
  correct number of zeros.  This also now works for the
  --min_rtt_timeout, --max_rtt_timeout, --initial_rtt_timeout,
  --scan_delay, and --max_scan_delay options.

o Improved the NmapFE port to GTK2 so it better-conforms to the new
  API and you don't get as many annoying messages in your terminal
  window.  GTK2 is prettier and more functional too.  Thanks to Priit
  Laes (amd(a)store20.com) for writing these
  excellent patches.

o Fixed a problem which led to the error message "Failed to determine
  dst MAC address for target" when you try to run Nmap using a
  dialup/PPP adapter on Windows rather than a real ethernet card.  Due
  to Microsoft breaking raw sockets, Nmap no longer supports dialup
  adapters, but it should now give you a clearer error message than
  the "dst MAC address" nonsense.

o Debian GNU/kFreeBSD is now supported thanks to a patch to libdnet's
  configure.in by Petr Salinger (Petr.Salinger(a)t-systems.cz).

o Tried to update to the latest autoconf only to find that there
  hasn't been a new version in more than two years :(.  I was able to
  find new config.sub and config.guess files at
  http://cvs.savannah.gnu.org/viewcvs/config/config/ , so I updated to
  those.

o Fixed a problem with the -e option when run on Windows (or UNIX with
  --send_eth) when run on an ethernet network against an external
  (routed) host.  You would get the message "NmapArpCache() can only
  take IPv4 addresses.  Sorry".  Thanks to KX (kxmail(a)gmail.com) for
  helping to track down the problem.

o Made some changes to allow source port zero scans (-g0).  Nmap used
  to refuse to do this, but now it just gives a warning that it may not
  work on all systems.  It seems to work fine on my Linux box.  Thanks
  to Bill Dale (bill_dale(a)bellsouth.net) for suggesting this feature.

o Made a change to libdnet so that Windows interfaces are listed as
  down if they are disconnected, unplugged, or otherwise unavailable.

o Ceased including foreign translations in the Nmap tarball as they
  take up too much space.  HTML versions can be found at
  http://www.insecure.org/nmap/docs.html , while XML and NROFF versions
  are available from http://www.insecure.org/nmap/data/man-xlate/ .

o Changed INSTALL and README-WIN32 files to mostly just reference the
  new Nmap Install Guide at http://www.insecure.org/nmap/install/ .

o Included docs/nmap-man.xml in the tarball distribution, which is the
  DocBook XML source for the Nmap man page.  Patches to Nmap that are
  user-visible should include patches to the man page XML source rather
  than to the generated Nroff.

o Fixed Nmap so it doesn't crash when you ask it to resume a previous
  scan, but pass in a bogus file rather than actual Nmap output.  Thanks
  to Piotr Sobolewski (piotr_sobolewski(a)o2.pl) for the fix.

Nmap 3.95

o Fixed a crash in IPID Idle scan.  Thanks to Ron
  (iago(a)valhallalegends.com>, Bakeman (bakeman(a)physics.unr.edu),
  and others for reporting the problem.

o Fixed an inefficiency in RPC scan that could slow things down and
  also sometimes resulted in the spurious warning message: "Unable to
  find listening socket in get_rpc_results"

o Fixed a 3.94ALPHA3 bug that caused UDP scan results to be listed as
  TCP ports instead.  Thanks to Justin M Cacak (jcacak(a)nebraska.edu)
  for reporting the problem.

Nmap 3.94ALPHA3

o Updated NmapFE to build with GTK2 rather than obsolete GTK1.  Thanks
  to Mike Basinger (dbasinge(a)speakeasy.net) and Meethune Bhowmick
  (meethune(a)oss-institute.org) for developing the
  patch.  I made some changes as well to prevent compilation warnings.
  The new NmapFE now seems to work, though I do get "Gtk-CRITICAL"
  assertion error messages.  If someone has time to look into this, that
  would be appreciated.

o Fixed a compilation problem on Mac OS X and perhaps other platforms
  with a one-line fix to scan_engine.cc.  Thanks to Felix Gröbert
  (felix(a)groebert.org) for notifying me of the problem.

o Fixed a problem that prevented the command "nmap -sT -PT <targets>"
  from working from a non-privileged user account.  The -PT option
  doesn't change default behavior in this case, but Nmap should (and now
  does) allow it.

o Applied another VS 2005 compatibility patch from KX (kxmail(a)gmail.com).

o Define INET_ADDRSTRLEN in tcpip.h if the system doesn't define it
  for us.  This apparently aids compilation on Solaris 2.6 and 7.
  Thanks to Albert Chin (nmap-hackers(a)mlists.thewrittenword.com) for
  sending the patch..

Nmap 3.94ALPHA2

o Put Nmap on a diet, with changes to the core port scanning routine
  (ultra_scan) to substantially reduce memory consumption, particularly
  when tens of thousands of ports are scanned.

o Fixed a problem with the -S and option on Windows reporting "Failed
  to resolve/decode supposed IPv4 source address".  The -D (decoy)
  option was probably broken on that platform too.  Thanks to KX
  (kxmail(a)gmail.com) for reporting the problem and tracking down a
  potential solution.

o Better handle ICMP type 3, code 0 (network unreachable) responses to
  port scan packets.  These are rarely seen when scanning hosts that
  are actually online, but are still worth handling.

o Applied some small fixes so that Nmap compiles with Visual C++
  2005 Express, which is free from Microsoft at
  http://msdn.microsoft.com/vstudio/express/visualc/ .  Thanks to KX
  (kxmail(a)gmail.com) and Sina Bahram (sbahram(a)nc.rr.com)

o Removed foreign translations of the old man page from the
  distribution.  Included the following contributed translations
  (nroff format) of the new man page:
    Brazilian Portuguese by Lucien Raven (lucienraven(a)yahoo.com.br)
    Portuguese (Portugal) by José Domingos (jd_pt(a)yahoo.com) and 
                             Andreia Gaita (shana.ufie(a)gmail.com).

o Added --thc option (undocumented)

o Modified libdnet-stripped/src/eth-bsd.c to allow for up to 128 bpf
  devices rather than 32.  This prevents errors like "Failed to open
  ethernet interface (fxp0)" when there are more than 32 interface
  aliases.  Thanks to Krok (krok(a)void.ru) for reporting the problem
  and even sending a patch.

Nmap 3.94ALPHA1

o Wrote a new man page from scratch.  It is much more comprehensive
  (more than twice as long) and (IMHO) better organized than the
  previous one.  Read it online at http://www.insecure.org/nmap/man/
  or docs/nmap.1 from the Nmap distribution.  Let me know if you have
  any ideas for improving it.

o Wrote a new "help screen", which you get when running Nmap without
  arguments.  It is also reproduced in the man page and at
  http://www.insecure.org/nmap/data/nmap.usage.txt .  I gave up trying
  to fit it within a 25-line, 80-column terminal window.  It is now 78
  lines and summarizes all but the most obscure Nmap options.

o Version detection softmatches (when Nmap determines the service
  protocol such as smtp but isn't able to determine the app name such as
  Postfix) can now parse out the normal match line fields such as
  hostname, device type, and extra info.  For example, we may not know
  what vendor created an sshd, but we can still parse out the protocol
  number.  This was a patch from  Doug Hoyte (doug(a)hcsw.org).

o Fixed a problem which caused UDP version scanning to fail to print
  the matched service.  Thanks to Martin Macok
  (martin.macok(a)underground.cz) for reporting the problem and Doug
  Hoyte (doug(a)hcsw.org) for fixing it.

o Made the version detection "ports" directive (in
  nmap-service-probes) more comprehensive.  This should speed up scans a
  bit.  The patch was done by Doug Hoyte (doug(a)hcsw.org).

o Added the --webxml option, which does the same thing as 
  --stylesheet http://www.insecure.org/nmap/data/nmap.xsl , without
  requiring you to remember the exact URL or type that whole thing.

o Fixed a crash occurred when the --exclude option was used with
  netmasks on certain platforms.  Thanks to Adam
  (nmapuser(a)globalmegahost.com) for reporting the problem and to
  Greg Darke (starstuff(a)optusnet.com.au) for sending a patch (I
  modified the patch a bit to make it more efficient).

o Fixed a problem with the -S and -e options (spoof/set
  source address, and set interface by name, respectively).  The problem
  report and a partial patch were sent by Richard Birkett
  (richard(a)musicbox.net).

o Fixed a possible aliasing problem in tcpip.cc by applying a patch sent in by
  Gwenole Beauchesne (gbeauchesne(a)mandriva.com).  This problem
  shouldn't have had any effect on users since we already include the
  -fno-strict-aliasing option whenever gcc 4 is detected, but it
  brings us closer to being able to remove that option.

o Fixed a bug that caused Nmap to crash if an nmap-service-probes file
  was used which didn't contain the Exclude directive.

o Fixed a bunch of typos and misspellings throughout the Nmap source
  code (mostly in comments).  This was a 625-line patch by Saint Xavier
  (skyxav(a)skynet.be).

o Nmap now accepts target list files in Windows end-of-line format (\r\n)
  as well as standard UNIX format (\n) on all platforms.  Passing a
  Windows style file to Nmap on UNIX didn't work before unless you ran
  dos2unix first.

o Removed Identd scan support from NmapFE since Nmap no longer
  supports it.  Thanks to Jonathan Dieter (jdieter99(a)gmx.net) for the
  patch.

o Integrated all of the September version detection fingerprint
  submissions.  This was done by Version Detection Czar Doug Hoyte
  (doug(a)hcsw.org) and resulted in 86 new match lines.  Please keep
  those submissions coming!

o Fixed a divide-by-zero crash when you specify rather bogus
  command-line arguments (a TCP scan with zero tcp ports).  Thanks to
  Bart Dopheide (dopheide(a)fmf.nl) for identifying the problem and
  sending a patch.

o Fixed a minor syntax error in tcpip.h that was causing problems with
  GCC 4.1.  Thanks to Dirk Mueller (dmuell(a)gmx.net) for reporting
  the problem and sending a fix.

Nmap 3.93

o Modified Libpcap's configure.ac to compile with the
  -fno-strict-aliasing option if gcc 4.X is used.  This prevents
  crashes when said compiler is used.  This was done for Nmap in 3.90, but is
  apparently needed for pcap too.  Thanks to Craig Humphrey
  (Craig.Humphrey(a)chapmantripp.com) for the discovery.

o Patched libdnet to include sys/uio.h in src/tun-linux.c.  This is
  apparently necessary on some Glibc 2.1 systems.  Thanks to Rob Foehl
  (rwf(a)loonybin.net) for the patch.

o Fixed a crash which could occur when a ridiculously short
  --host_timeout was specified on Windows (or on UNIX if --send_eth was
  specified).  Nmap now also prints a warning if you specify a
  host_timeout of less than 1 second.  Thanks to Ole Morten Grodaas
  (grodaas(a)gmail.com) for discovering the problem.

Nmap 3.91

o Fixed a crash on Windows when you -P0 scan an unused IP on a local
  network (or a range that contains unused IPs).  This could also
  happen on UNIX if you specified the new --send_eth option.  Thanks
  to Jim Carras (JFCECL(a)engr.psu.edu) for reporting the problem.

o Fixed compilation on OpenBSD by applying a patch from Okan Demirmen
  (okan(a)demirmen.com), who maintains Nmap in the OpenBSD Ports
  collection.

o Updated nmap-mac-prefixes to include OUIs assigned by the IEEE since
  April.

o Updated the included libpcre (used for version detection) from
  version 4.3 to 6.3.  A libpcre security issue was fixed in 6.3, but
  that issue never affected Nmap.

o Updated the included libpcap from 0.8.3 to 0.9.3.  I also changed
  the directory name in the Nmap tarball from libpcap-possiblymodified
  to just libpcap.  As usual, the modifications are described in the
  NMAP_MODIFICATIONS in that directory.

Nmap 3.90

o Added the ability for Nmap to send and properly route raw ethernet
  packets containing IP datagrams rather than always sending the
  packets via raw sockets. This is particularly useful for Windows,
  since Microsoft has disabled raw socket support in XP for no good
  reason.  Nmap tries to choose the best method at runtime based on
  platform, though you can override it with the new --send_eth and
  --send_ip options.

o Added ARP scanning (-PR). Nmap can now send raw ethernet ARP requests to
  determine whether hosts on a LAN are up, rather than relying on
  higher-level IP packets (which can only be sent after a successful
  ARP request and reply anyway).  This is much faster and more
  reliable (not subject to IP-level firewalling) than IP-based probes.
  The downside is that it only works when the target machine is on the
  same LAN as the scanning machine.  It is now used automatically for
  any hosts that are detected to be on a local ethernet network,
  unless --send_ip was specified.  Example usage: nmap -sP -PR
  192.168.0.0/16 .

o Added the --spoof_mac option, which asks Nmap to use the given MAC
  address for all of the raw ethernet frames it sends.  The MAC given
  can take several formats.  If it is simply the string "0", Nmap
  chooses a completely random MAC for the session.  If the given
  string is an even number of hex digits (with the pairs optionally
  separated by a colon), Nmap will use those as the MAC.  If less than
  12 hex digits are provided, Nmap fills in the remainder of the 6
  bytes with random values.  If the argument isn't a 0 or hex string,
  Nmap looks through the nmap-mac-prefixes to find a vendor name
  containing the given string (it is case insensitive).  If a match is
  found, Nmap uses the vendor's OUI (3-byte prefix) and fills out the
  remaining 3 bytes randomly.  Valid --spoof_mac argument examples are
  "Apple", "0", "01:02:03:04:05:06", "deadbeefcafe", "0020F2", and
  "Cisco".

o Applied an enormous nmap-service-probes (version detection) update
  from SoC student Doug Hoyte (doug(a)hcsw.org).  Version 3.81 had
  1064 match lines covering 195 service protocols.  Now we have 2865
  match lines covering 359 protocols!  So the database size has nearly
  tripled!  This should make your -sV scans quicker and more
  accurate.  Thanks also go to the (literally) thousands of you who
  submitted service fingerprints.  Keep them coming!

o Applied a massive OS fingerprint update from Zhao Lei
  (zhaolei(a)gmail.com).  About 350 fingerprints were added, and many
  more were updated.  Notable additions include Mac OS X 10.4 (Tiger),
  OpenBSD 3.7, FreeBSD 5.4, Windows Server 2003 SP1, Sony AIBO (along
  with a new "robotic pet" device type category), the latest Linux 2.6
  kernels Cisco routers with IOS 12.4, a ton of VoIP devices, Tru64
  UNIX 5.1B, new Fortinet firewalls, AIX 5.3, NetBSD 2.0, Nokia IPSO
  3.8.X, and Solaris 10.  Of course there are also tons of new
  broadband routers, printers, WAPs and pretty much any other device
  you can coax an ethernet cable (or wireless card) into!

o Added 'leet ASCII art to the configurator!  ARTIST NOTE: If you think
  the ASCII art sucks, feel free to send me alternatives.  Note that
  only people compiling the UNIX source code get this. (ASCII artist
  unknown).

o Added OS, device type, and hostname detection using the service
  detection framework.  Many services print a hostname, which may be
  different than DNS.  The services often give more away as well.  If
  Nmap detects IIS, it reports an OS family of "Windows".  If it sees
  HP JetDirect telnetd, it reports a device type of "printer".  Rather
  than try to combine TCP/IP stack fingerprinting and service OS
  fingerprinting, they are both printed.  After all, they could
  legitimately be different.  An IP that gives a stack fingerprint
  match of "Linksys WRT54G broadband router" and a service fingerprint
  of Windows based on Kazaa running is likely a common NAT setup rather
  than an Nmap mistake.

o Nmap on Windows now compiles/links with the new WinPcap 3.1
  header/lib files. So please upgrade to 3.1 from
  http://www.winpcap.org before installing this version of Nmap.
  While older versions may still work, they aren't supported with Nmap.

o The official Nmap RPM files are now compiled statically for better
  compatibility with other systems.  X86_64 (AMD Athlon64/Opteron)
  binaries are now available in addition to the standard i386.  NmapFE
  RPMs are no longer distributed by Insecure.Org.

o Nmap distribution signing has changed. Release files are now signed
  with a new Nmap Project GPG key (KeyID 6B9355D0).  Fyodor has also
  generated a new key for himself (KeyID 33599B5F).  The Nmap key has
  been signed by Fyodor's new key, which has been signed by Fyodor's
  old key so that you know they are legit.  The new keys are available
  at http://www.insecure.org/nmap/data/nmap_gpgkeys.txt , as
  docs/nmap_gpgkeys.txt in the Nmap source tarball, and on the public
  keyserver network.  Here are the fingerprints:
    pub  1024D/33599B5F 2005-04-24
         Key fingerprint = BB61 D057 C0D7 DCEF E730  996C 1AF6 EC50 3359 9B5F
    uid  Fyodor <fyodor@insecure.org>
    sub  2048g/D3C2241C 2005-04-24

    pub  1024D/6B9355D0 2005-04-24
         Key fingerprint = 436D 66AB 9A79 8425 FDA0  E3F8 01AF 9F03 6B93 55D0
    uid  Nmap Project Signing Key (http://www.insecure.org/)
    sub  2048g/A50A6A94 2005-04-24

o Fixed a crash problem related to non-portable varargs (vsnprintf)
  usage. Reports of this crash came from Alan William Somers
  (somers(a)its.caltech.edu) and Christophe (chris.branch(a)gmx.de).
  This patch was prevalent on Linux boxes running an Opteron/Athlon64
  CPU in 64-bit mode.

o Fixed crash when Nmap is compiled using gcc 4.X by adding the
  -fno-strict-aliasing option when that compiler is detected.  Thanks
  to Greg Darke (starstuff(a)optusnet.com.au) for discovering that
  this option fixes (hides) the problem and to Duilio J. Protti
  (dprotti(a)flowgate.net) for writing the configure patch to detect
  gcc 4 and add the option.  A better fix is to identify and rewrite
  lines that violate C99 alias rules, and we are looking into that.

o Added "rarity" feature to Nmap version detection.  This causes
  obscure probes to be skipped when they are unlikely to help.  Each
  probe now has a "rarity" value.  Probes that detect dozens of
  services such as GenericLines and GetRequest have rarity values of
  1, while the WWWOFFLEctrlstat and mydoom probes have a rarity of 9.
  When interrogating a port, Nmap always tries probes registered to
  that port number.  So even WWWOFFLEctrlstat will be tried against
  port 8081 and mydoom will be tried against open ports between 3127
  and 3198.  If none of the registered ports find a match, Nmap tries
  probes that have a rarity less than or equal to its current
  intensity level.  The intensity level defaults to 7 (so that most of
  the probes are done).  You can set the intensity level with the new
  --version_intensity option.  Alternatively, you can just use
  --version_light or --version_all which set the intensity to 2 (only
  try the most important probes and ones registered to the port
  number) and 9 (try all probes), respectively.  --version_light is
  much faster than default version detection, but also a bit less
  likely to find a match.  This feature was designed and implemented
  by Doug Hoyte (doug(a)hcsw.org).

o Added a "fallback" feature to the nmap-service-probes database.
  This allows a probe to "inherit" match lines from other probes.  It
  is currently only used for the HTTPOptions, RTSPRequest, and
  SSLSessionReq probes to inherit all of the match lines from
  GetRequest.  Some servers don't respond to the Nmap GetRequest (for
  example because it doesn't include a Host: line) but they do respond
  to some of those other 3 probes in ways that GetRequest match lines
  are general enough to match.  The fallback construct allows us to
  benefit from these matches without repeating hundreds of signatures
  in the file.  This is another feature designed and implemented
  by Doug Hoyte (doug(a)hcsw.org).

o Fixed crash with certain --excludefile or
  --exclude arguments.  Thanks to Kurt Grutzmacher
  (grutz(a)jingojango.net) and pijn trein (ptrein(a)gmail.com) for
  reporting the problem, and to Duilio J. Protti
  (dprotti(a)flowgate.net) for debugging the issue and sending the
  patch.

o Updated random scan (ip_is_reserved()) to reflect the latest IANA
  assignments.  This patch was sent in by Felix Groebert
  (felix(a)groebert.org).

o Included new Russian man page translation by
  locco_bozi(a)Safe-mail.net

o Applied patch from Steve Martin (smartin(a)stillsecure.com) which
  standardizes many OS names and corrects typos in nmap-os-fingerprints.

o Fixed a crash found during certain UDP version scans.  The crash was
  discovered and reported by Ron (iago(a)valhallalegends.com) and fixed
  by Doug Hoyte (doug(a)hcsw.com).

o Added --iflist argument which prints a list of system interfaces and
  routes detected by Nmap.

o Fixed a protocol scan (-sO) problem which led to the error message:
  "Error compiling our pcap filter: syntax error".  Thanks to Michel
  Arboi (michel(a)arboi.fr.eu.org) for reporting the problem.

o Fixed an Nmap version detection crash on Windows which led to the
  error message "Unexpected error in NSE_TYPE_READ callback.  Error
  code: 10053 (Unknown error)".  Thanks to Srivatsan
  (srivatsanp(a)adventnet.com) for reporting the problem.

o Fixed some misspellings in docs/nmap.xml reported by Tom Sellers
  (TSellers(a)trustmark.com).

o Applied some changes from  Gisle Vanem (giva(a)bgnett.no) to make
  Nmap compile with Cygwin.

o XML "osmatch" element now has a "line" attribute giving the
  reference fingerprint line number in nmap-os-fingerprints.

o Added a distcc probes and a bunch of smtp matches from Dirk Mueller
  (mueller(a)kde.org) to nmap-service-probes.  Also added AFS version
  probe and matches from Lionel Cons (lionel.cons(a)cern.ch).  And
  even more probes and matches from Martin Macok
  (martin.macok(a)underground.cz)

o Fixed a problem where Nmap compilation would use header files from
  the libpcap included with Nmap even when it was linking to a system
  libpcap.  Thanks to Solar Designer (solar(a)openwall.com) and Okan
  Demirmen (okan(a)demirmen.com) for reporting the problem.

o Added configure option --with-libpcap=included to tell Nmap to use
  the version of libpcap it ships with rather than any that may already be
  installed on the system.  You can still use --with-libpcap=[dir] to
  specify that a system libpcap be installed rather than the shipped
  one.  By default, Nmap looks at both and decides which one is likely
  to work best.  If you are having problems on Solaris, try
  --with-libpcap=included .

o Changed the --no-stylesheet option to --no_stylesheet to be
  consistent with all of the other Nmap options.  Though I'm starting to
  like hyphens a bit better than underscores and may change all of the
  options to use hyphens instead at some point.

o Added "Exclude" directive to nmap-service-probes grammar which
  causes version detection to skip listed ports.  This is helpful for
  ports such as 9100.  Some printers simply print any data sent to
  that port, leading to pages of HTTP requests, SMB queries, X Windows
  probes, etc.  If you really want to scan all ports, specify
  --allports.  This patch came from Doug Hoyte (doug(a)hcsw.org).

o Added a stripped-down and heavily modified version of Dug Song's
  libdnet networking library (v. 1.10).  This helps with the new raw
  ethernet features.  My (extensive) changes are described in
  libdnet-stripped/NMAP_MODIFICATIONS

o Removed WinIP library (and all Windows raw sockets code) since MS
  has gone and broken raw sockets.  Maybe packet receipt via raw
  sockets will come back at some point.  As part of this removal, the
  Windows-specific --win_help, --win_list_interfaces, --win_norawsock,
  --win_forcerawsock, --win_nopcap, --win_nt4route, --win_noiphlpapi,
  and --win_trace options have been removed.

o Changed the interesting ports array from a 65K-member array of
  pointers into an STL list.  This noticeable reduces memory usage in
  some cases, and should also give a slight runtime performance
  boost. This patch was written by Paul Tarjan (ptarjan(a)gmail.com).

o Removed the BSDFIX/BSDUFIX macros.  The underlying bug in
  FreeBSD/NetBSD is still there though.  When an IP packet is sent
  through a raw socket, these platforms require the total length and
  fragmentation offset fields of an IP packet to be in host byte order
  rather than network byte order, even though all the other fields
  must be in NBO.  I believe that OpenBSD fixed this a while back.
  Other platforms, such as Linux, Solaris, Mac OS X, and Windows take
  all of the fields in network byte order.  While I removed the macro,
  I still do the munging where required so that Nmap still works on
  FreeBSD.

o Integrated many nmap-service-probes changes from Bo Jiang
  (jiangbo(a)brandeis.edu)

o Added a bunch of RPC numbers from nmap-rpc maintainer Eilon Gishri
  (eilon(a)aristo.tau.ac.il)

o Added some new RPC services to nmap-rpc thanks to a patch from
  vlad902 (vlad902(a)gmail.com).

o Fixed a bug where Nmap would quit on Windows whenever it encountered
  a raw scan of localhost (including the local ethernet interface
  address), even when that was just one address out of a whole network
  being scanned.  Now Nmap just warns that it is skipping raw scans when
  it encounters the local IP, but continues on to scan the rest of the
  network.  Raw scans do not currently work against local IP addresses
  because Winpcap doesn't support reading/writing localhost interfaces
  due to limitations of Windows.

o The OS fingerprint is now provided in XML output if debugging is
  enabled (-d) or verbosity is at least 2 (-v -v).  This patch was
  sent by Okan Demirmen (okan(a)demirmen.com)

o Fixed the way tcp connect scan (-sT) response to ICMP network
  unreachable responses (patch by Richard Moore
  (rich(a)westpoint.ltd.uk).

o Update random host scan (-iR) to support the latest IANA-allocated
  ranges, thanks to patch by Chad Loder (cloder(a)loder.us).

o Updated GNU shtool (a helper program used during 'make install' to
  version 2.0.2, which fixes a predictable temporary filename
  weakness discovered by Eric Raymond.

o Removed addport element from XML DTD, since it is no longer used
  (suggested by Lionel Cons (lionel.cons(a)cern.ch)

o Added new --privileged command-line option and NMAP_PRIVILEGED
  environmental variable.  Either of these tell Nmap to assume that
  the user has full privileges to execute raw packet scans, OS
  detection and the like.  This can be useful when Linux kernel
  capabilities or other systems are used that allow non-root users to
  perform raw packet or ethernet frame manipulation.  Without this
  flag or variable set, Nmap bails on UNIX if geteuid() is
  nonzero.

o Changed the RPM spec file so that if you define "static" to 1 (by
  passing --define "static 1" to rpmbuild), static binaries are built.

o Fixed Nmap compilation on Solaris x86 thanks to a patch from Simon
  Burr (simes(a)bpfh.net).

o ultra_scan() now sets pseudo-random ACK values (rather than 0) for
  any TCP scans in which the initial probe packet has the ACK flag set.
  This would be the ACK, Xmas, Maimon, and Window scans.

o Updated the Nmap version number, description, and similar fields
  that MS Visual Studio places in the binary.  This was done by editing
  mswin32/nmap.rc as suggested by Chris Paget (chrisp(a)ngssoftware.com)

o Fixed Nmap compilation on DragonFly BSD (and perhaps some other
  systems) by applying a short patch by Joerg Sonnenberger which omits
  the declaration of errno if it is a #define.

o Fixed an integer overflow that prevented Nmap from scanning
  2,147,483,648 hosts in one expression (e.g. 0.0.0.0/1).  Problem
  noted by Justin Cranford (jcranford(a)n-able.com).  While /1 scans
  are now possible, don't expect them to finish during your bathroom
  break.  No matter how constipated you are.

o Increased the buffer size allocated for fingerprints to prevent Nmap
  from running out and quitting (error message: "Assertion
  `servicefpalloc - servicefplen > 8' failed".  Thanks to Mike Hatz
  (mhatz(a)blackcat.com) for the report. [ Actually this was done in a
  previous version, but I forgot which one ]

o Changed from CVS to Subversion source control system (which
  rocks!). Neither repository is public (I'm paranoid because both CVS
  and SVN have had remotely exploitable security holes), so the main
  change users will see is that "Id" tags in file headers use the SVN
  format for version numbering and such.

Nmap 3.81

o Nmap now ships with and installs (in the same directory as other
  data files such as nmap-os-fingerprints) an XSL stylesheet for
  rendering the XML output as HTML.  This stylesheet was written by
  Benjamin Erb ( see http://www.benjamin-erb.de/nmap/ for examples).
  It supports tables, version detection, color-coded port states, and
  more.  The XML output has been augmented to include an
  xml-stylesheet directive pointing to nmap.xsl on the local
  filesystem.  You can point to a different XSL file by providing the
  filename or URL to the new --stylesheet argument.  Omit the
  xml-stylesheet directive entirely by specifying --no-stylesheet.
  The XML to HTML conversion can be done with an XSLT processor such
  as Saxon, Sablot, or Xalan, but modern browsers can do this on the
  fly -- simply load the XML output file in IE or Firefox.  Some
  features don't currently work with Firefox's on-the-fly rendering.
  Perhaps some Mozilla wizard can fix that in either the XSL or the
  browser itself.  I hate having things work better in IE :).  It is
  often more convenient to have the stylesheet loaded from a URL
  rather than the local filesystem, allowing the XML to be rendered on
  any machine regardless of whether/where the XSL is installed.  For
  privacy reasons (avoid loading of an external URL when you view
  results), Nmap uses the local filesystem by default.  If you would
  like the latest version of the stylesheet loaded from the web when
  rendering, specify 
  --stylesheet http://www.insecure.org/nmap/data/nmap.xsl .

o Fixed fragmentation option (-f).  One -f now sets sends fragments
  with just 8 bytes after the IP header, while -ff sends 16 bytes to
  reduce the number of fragments needed.  You can specify your own
  fragmentation offset (must be a multiple of 8) with the new --mtu
  flag.  Don't also specify -f if you use --mtu.  Remember that some
  systems (such as Linux with connection tracking) will defragment in
  the kernel anyway -- so test first while sniffing with ethereal.
  These changes are from a patch by Martin Macok
  (martin.macok(a)underground.cz).

o Nmap now prints the number (and total bytes) of raw IP packets sent
  and received when it completes, if verbose mode (-v) is enabled.  The
  report looks like:
  Nmap finished: 256 IP addresses (3 hosts up) scanned in 30.632 seconds
                 Raw packets sent: 7727 (303KB) | Rcvd: 6944 (304KB)

o Fixed (I hope) an error which would cause the Windows version of
  Nmap to abort under some circumstances with the error message
  "Unexpected error in NSE_TYPE_READ callback.  Error code: 10053
  (Unknown error)".  Problem reported by "Tony Golding"
  (biz(a)tonygolding.com).

o Added new "closed|filtered" state.  This is used for Idle scan, since
  that scan method can't distinguish between those two states.  Nmap
  previously just used "closed", but this is more accurate.

o Null, FIN, Maimon, and Xmas scans now mark ports as "open|filtered"
  instead of "open" when they fail to receive any response from the
  target port.  After all, it could just as easily be filtered as open.
  This is the same change that was made to UDP scan in 3.70.  Also as
  with UDP scan, adding version detection (-sV) will change the state
  from open|filtered to open if it confirms that they really are open.

o Fixed a bug in ACK scan that could cause Nmap to crash with the
  message "Unexpected port state: 6" in some cases.  Thanks to Glyn
  Geoghegan (glyng(a)corsaire.com) for reporting the problem.

o Change IP protocol scan (-sO) so that a response from the target
  host in any protocol at all will prove that protocol is open.  As
  before, no response means "open|filtered", an ICMP protocol
  unreachable means "closed", and most other ICMP error messages mean
  "filtered".

o Patched a libpcap issue that prevented read timeouts from being
  honored on Solaris (thus slowing down Nmap substantially).  The
  problem report and patch were sent in by Ben Harris
  (bjh21(a)cam.ac.uk).

o Changed IP protocol scan (-sO) so that it sends valid ICMP, TCP, and
  UDP headers when scanning protocols 1, 6, and 17, respectively.  An
  empty IP header is still sent for all other protocols.  This should
  prevent the error messages such as "sendto in send_ip_packet:
  sendto(3, packet, 20, 0, 192.31.33.7, 16) => Operation not
  permitted" that Linux (and perhaps other systems) would give when
  they try to interpret the raw packet.  This also makes it more
  likely that these protocols will elicit a response, proving that the
  protocol is "open".

o The windows build now uses header and static library files from
  Winpcap 3.1Beta4.  It also now prints out the DLL version you are
  using when run with -d.  I would recommend upgrading to 3.1Beta4 if
  you have an older Winpcap installed.

o Nmap now prints a warning message on Windows if Winpcap is not found
  (it then reverts to raw sockets mode if available, as usual).

o Added an NTP probe and matches to the version detection database
  (nmap-service-probes) thanks to a submission from Martin
  Macok (martin.macok(a)underground.cz).

o Applied several Nmap service detection database updates sent in by
  Martin Macok (martin.macok(a)underground.cz).

o The XML nmaprun element now has a startstr attribute which gives the
  human readable calendar time format that a scan started.  Similarly
  the finished element now has a timestr attribute describing when the
  scan finished.  These are in addition to the existing nmaprun/start
  and finished/time attributes that provided the start and finish time
  in UNIX time_t notation.  This should help in development of
  XSLT stylesheets for Nmap XML output.

o Fixed a memory leak that would generally consume several hundred
  bytes per down host scanned.  While the effect for most scans is
  negligible, it was overwhelming when Scott Carlson
  (Scott.Carlson(a)schwab.com) tried to scan 16.8 million IPs
  (10.0.0.0/8).  Thanks to him for reporting the problem.  Also thanks
  to Valgrind ( http://valgrind.kde.org ) for making it easy to debug.

o Fixed a crash on Windows systems that don't include the iphlpapi
  DLL.  This affects Win95 and perhaps other variants.  Thanks to Ganga
  Bhavani (GBhavani(a)everdreamcorp.com) for reporting the problem and
  sending the patch.

o Ensured that the device type, os vendor, and os family OS
  fingerprinting classification values are scrubbed for XML compliance
  in the XML output.  Thanks to Matthieu Verbert
  (mve(a)zurich.ibm.com) for reporting the problem and sending a patch.

o Rewrote the host IP (target specification) parser for easier
  maintenance and to fix a bug found by Netris (netris(a)ok.kz)

o Changed to Nmap XML DTD to use the same xmloutputversion (1.01) as
  newer versions of Nmap.  Thanks to Laurent Estieux
  (laurent.estieux(a)free.fr) for reporting the problem.

o Fixed compilation on some HP-UX 11 boxes thanks to a patch by Petter
  Reinholdtsen (pere(a)hungry.com).

o Fixed a portability problem on some OpenBSD and FreeBSD machines
  thanks to a patch by Okan Demirmen (okan(a)demirmen.com).

o Applied Martin Macok's (martin.macok(a)underground.cz) "cosmetics
  patch", which fixes a few typos and minor problems.

Nmap 3.75

o Implemented a huge OS fingerprint database update.  The number of
  fingerprints increased more than 20% to 1,353 and many of the
  existing ones are much improved.  Notable updates include the fourth
  edition of Bell Lab's Plan9, Grandstream's BugeTone 101 IP Phone,
  and Bart's Network Boot Disk 2.7 (which runs MS-DOS).  Oh, and Linux
  kernels up to 2.6.8, dozens of new Windows fingerprints including XP
  SP2, the latest Longhorn warez, and many modified Xboxes, OpenBSD
  3.6, NetBSD up to 2.0RC4, Apple's AirPort Express WAP and OS X
  10.3.3 (Panther) release, Novell Netware 6.5, FreeBSD 5.3-BETA, a
  bunch of Linksys and D-Link consumer junk, the latest Cisco IOS 12.2
  releases, a ton of miscellaneous broadband routers and printers, and
  much more.

o Updated nmap-mac-prefixes with the latest OUIs from the IEEE.
  [ http://standards.ieee.org/regauth/oui/oui.txt ]

o Updated nmap-protocols with the latest IP protocols from IANA 
  [ http://www.iana.org/assignments/protocol-numbers ]

o Added a few new Nmap version detection signatures thanks to a patch
  from Martin Macok (martin.macok(a)underground.cz).

o Fixed a crash problem in the Windows version of Nmap, thanks to a
  patch from Ganga Bhavani GBhavani(a)everdreamcorp.com).

o Fixed Windows service scan crashes that occur with the error message
  "Unexpected nsock_loop error. Error code 10022 (Unknown error)".  It
  turns out that Windows does not allow select() calls with all three
  FD sets empty.  Lame.  The Linux select() man page even suggests
  calling "select with all three sets empty, n zero, and a non-null
  timeout as a fairly portable way to sleep with subsecond precision."
  Thanks to Gisle Vanem (giva(a)bgnett.no) for debugging help.

o Added --max_scan_delay parameter.  Nmap will sometimes increase the
  delay itself when it detects many dropped packets.  For example,
  Solaris systems tend to respond with only one ICMP port unreachable
  packet per second during a UDP scan.  So Nmap will try to detect
  this and lower its rate of UDP probes to one per second.  This can
  provide more accurate results while reducing network congestion, but
  it can slow the scans down substantially.  By default (with no -T
  options specified), Nmap allows this delay to grow to one second per
  probe.  This option allows you to set a lower or higher maximum.
  The -T4 and -T5 scan modes now limit the maximum scan delay for TCP
  scans to 10 and 5 ms, respectively.

o Fixed a bug that prevented RPC scan (-sR) from working for UDP ports
  unless service detection (-sV) was used.  -sV is still usually a
  better approach than -sR, as the latter ONLY handles RPC.  Thanks to
  Stephen Bishop (sbishop(a)idsec.co.uk) for reporting the problem and
  sending a patch.

o Fixed nmap_fetchfile() to better find custom versions of data files
  such as nmap-services.  Note that the implicitly read directory
  should be ~/.nmap rather than ~/nmap .  So you may have to move any
  customized files you now have in ~/nmap .  Thanks to nnposter
  (nnposter(a)users.sourceforge.net) for reporting the problem and
  sending a patch.

o Changed XML output so that the MAC address [address] element comes
  right after the IPv4/IPv6 [address] element.  Apparently this is
  needed to comply with the DTD (
  http://www.insecure.org/nmap/data/nmap.dtd ).  Thanks to Adam Morgan
  (adam.morgan(a)Q1Labs.com) and Florian Ebner
  (Florian.Ebner(a)e-bros.de) for the problem reports.

o Fixed an error in the Nmap RPM spec file reported by Pascal Trouvin
  (pascal.trouvin(a)wanadoo.fr)

o Fixed a timing problem in which a specified large --send_delay would
  sometimes be reduced to 1 second during a scan.  Thanks to Martin
  Macok (martin.macok(a)underground.cz) for reporting the problem.

o Fixed a timing problem with sneaky and paranoid modes (-T1 and -T0)
  which would cause Nmap to continually scan the same port and never
  hit other ports when scanning certain firewalled hosts.  Thanks to
  Curtis Doty (Curtis(a)GreenKey.net) for reporting the problem.

o Fixed a bug in the build system that caused most Nmap subdirectories
  to be configured twice.  Changing the variable holding the name of
  subdirs from $subdirs to $nmap_cfg_subdirs resolved the problem --
  configure must have been using that variable name for its own internal
  operations.  Anyway, this should reduce compile time significantly.

o Made a trivial change to nsock/src/nsock_event.c to work around a "a
  bug in GCC 3.3.1 on FreeBSD/sparc64".  I found the patch by digging
  around the FreeBSD ports tree repository.  It would be nice if the
  FreeBSD Nmap port maintainers would report such things to me, rather
  than fixing it in their own Nmap tree and then applying the patch to
  every future version.  On the other hand, they deserve some sort of
  "most up-to-date" award.  I stuck Nmap 3.71-PRE1 in the dist
  directory for a few people to test, and made no announcement or
  direct link.  The FreeBSD crew found it and upgraded anyway :).  The
  gcc-workaround patch was apparently submitted to the FreeBSD folks
  by Marius Strobl (marius(a)alchemy.franken.de).

o Fixed (I hope) an OS detection timing issue which would in some
  cases lead to the warning that "insufficient responses for TCP
  sequencing (3), OS detection may be less accurate."  Thanks to Adam
  Kerrison (adam(a)tideway.com) for reporting the problem.

o Modified the warning given when files such as nmap-services exist in
  both the compiled in NMAPDATADIR and the current working directory.
  That message should now only appear once and is more clear.

o Fixed ping scan subsystem to work a little bit better when
  --scan_delay (or some of the slower -T templates which include a scan
  delay) is specified.  Thanks to Shahid Khan (khan(a)asia.apple.com)
  for suggestions.

o Taught connect() scan to properly interpret ICMP protocol
  unreachable messages.  Thanks to Alan Bishoff
  (abishoff(a)arc.nasa.gov) for the report.

o Improved the nmapfe.desktop file to better comply with standards.
  Thanks to Stephane Loeuillet (stephane.loeuillet(a)tiscali.fr) for
  sending the patch.

Nmap 3.70

o Rewrote core port scanning engine, which is now named ultra_scan().
  Improved algorithms make this faster (often dramatically so) in
  almost all cases.  Not only is it superior against single hosts, but
  ultra_scan() can scan many hosts (sometimes hundreds) in parallel.
  This offers many efficiency/speed advantages.  For example, hosts
  often limit the ICMP port unreachable packets used by UDP scans to
  1/second.  That made those scans extraordinarily slow in previous
  versions of Nmap.  But if you are scanning 100 hosts at once,
  suddenly you can receive 100 responses per second.  Spreading the
  scan amongst hosts is also gentler toward the target hosts.  Nmap
  can still scan many ports at the same time, as well.  If you find
  cases where ultra_scan is slower or less accurate, please send a
  report (including exact command-lines, versions used, and output, if
  possible) to Fyodor.

o Added --max_hostgroup option which specifies the maximum number of
  hosts that Nmap is allowed to scan in parallel.

o Added --min_hostgroup option which specifies the minimum number of
  hosts that Nmap should scan in parallel (there are some exceptions
  where Nmap will still scan smaller groups -- see man page).  Of
  course, Nmap will try to choose efficient values even if you don't
  specify hostgroup restrictions explicitly.

o Rewrote TCP SYN, ACK, Window, and Connect() scans to use
  ultra_scan() framework, rather than the old pos_scan().

o Rewrote FIN, Xmas, NULL, Maimon, UDP, and IP Protocol scans to use
  ultra_scan(), rather than the old super_scan().

o Overhauled UDP scan.  Ports that don't respond are now classified as
  "open|filtered" (open or filtered) rather than "open".  The (somewhat
  rare) ports that actually respond with a UDP packet to the empty
  probe are considered open.  If version detection is requested, it
  will be performed on open|filtered ports.  Any that respond to any of
  the UDP probes will have their status changed to open.  This avoids a
  the false-positive problem where filtered UDP ports appear to be
  open, leading to terrified newbies thinking their machine is
  infected by back orifice.

o Nmap now estimates completion times for almost all port scan types
  (any that use ultra_scan()) as well as service scan (version
  detection).  These are only shown in verbose mode (-v).  On scans
  that take more than a minute or two, you will see occasional updates
  like:
  SYN Stealth Scan Timing: About 30.01% done; ETC: 16:04 (0:01:09 remaining)
  New updates are given if the estimates change significantly.

o Added --exclude option, which lets you specify a comma-separated
  list of targets (hosts, ranges, netblocks) that should be excluded
  from the scan.  This is useful to keep from scanning yourself, your
  ISP, particularly sensitive hosts, etc.  The new --excludefile reads
  the list (newline-delimited) from a given file.  All the work was
  done by Mark-David McLaughlin (mdmcl(a)cisco.com> and William McVey
  ( wam(a)cisco.com ), who sent me a well-designed and well-tested
  patch.

o Nmap now has a "port scan ping" system.  If it has received at least
  one response from any port on the host, but has not received
  responses lately (usually due to filtering), Nmap will "ping" that
  known-good port occasionally to detect latency, packet drop rate,
  etc.

o Service/version detection now handles multiple hosts at once for
  more efficient and less-intrusive operation.

o Nmap now wishes itself a happy birthday when run on September 1 in
  verbose mode!  The first public release was on that date in 1997.

o The port randomizer now has a bias toward putting
  commonly-accessible ports (80, 22, etc.) near the beginning of the
  list.  Getting a response early helps Nmap calculate response times and
  detect packet loss, so the scan goes faster.

o Host timeout system (--host_timeout) overhauled to support host
  parallelization.  Hosts times are tracked separately, so a host that
  finishes a SYN scan quickly is not penalized for an exceptionally
  slow host being scanned at the same time.

o When Nmap has not received any responses from a host, it can now
  use certain timing values from other hosts from the same scan
  group.  This way Nmap doesn't have to use absolute-worst-case
  (300bps SLIP link to Uzbekistan) round trip timeouts and such.

o Enabled MAC address reporting when using the Windows version
  of Nmap.  Thanks to Andy Lutomirski (luto(a)stanford.edu) for
  writing and sending the patch.

o Workaround crippled raw sockets on Microsoft Windows XP SP2 scans.
  I applied a patch by Andy Lutomirski (luto(a)stanford.edu) which
  causes Nmap to default to WinPcap sends instead.  The WinPcap send
  functionality was already there for versions of Windows such as NT and
  Win98 that never supported Raw Sockets in the first place.

o Changed how Nmap sends ARP requests on Windows to use the iphlpapi
  SendARP() function rather than creating it raw and reading the
  response from the Windows ARP cache.  This works around a
  (reasonable) feature of Windows Firewall which ignored such
  unsolicited responses.  The firewall is turned on by default as of
  Windows XP SP2.  This change was implemented by Dana Epp
  (dana(a)vulscan.com).

o Fixed some Windows portability issues discovered by Gisle Vanem
  (giva(a)bgnett.no).

o Upgraded libpcap from version 0.7.2 to 0.8.3.  This was an attempt
  to fix an annoying bug, which I then found was actually in my code
  rather than libpcap :).

o Removed Ident scan (-I).  It was rarely useful, and the
  implementation would have to be rewritten for the new ultra_scan()
  system.  If there is significant demand, perhaps I'll put it back in
  sometime.

o Documented the --osscan_limit option, which saves time by skipping
  OS detection if at least one open and one closed port are not found on
  the remote hosts.  OS detection is much less reliable against such
  hosts anyway, and skipping it can save some time.

o Updated nmapfe.desktop file to provide better NmapFE desktop support
  under Fedora Core and other systems.  Thanks to Mephisto
  (mephisto(a)mephisto.ma.cx) for sending the patch.

o Further nmapfe.desktop changes to better fit the freedesktop
  standard.  The patch came from Murphy (m3rf(a)swimmingnoodle.com).

o Fixed capitalization (with a Perl script) of many over-capitalized
  vendor names in nmap-mac-prefixes.

o Ensured that MAC address vendor names are always escaped in XML
  output if they contain illegal characters (particularly '&').  Thanks
  to Matthieu Verbert (mve(a)zurich.ibm.com) for the report and a patch.

o Changed xmloutputversion in XML output from 1.0 to 1.01 to note that
  there was a slight change (which was actually the MAC stuff in 3.55).
  Thanks to Lionel CONS (lionel.cons(a)cern.ch) for the suggestion.

o Many Windows portability fix and bug fixes, thanks to patch from
  Gisle Vanem (giva(a)bgnett.no).  With these changes, he was able to
  compile Nmap on Windows using MingW + gcc 3.4 C++ rather than MS
  Visual Studio.

o Removed (addport) tags from XML output.  They used to provide open
  ports as they were discovered, but don't work now that the port
  scanners scan many hosts at once.  They did not specify an IP
  address.  Of course the appropriate (port) tags are still printed
  once scanning of a target is complete.

o Configure script now detects GNU/k*BSD systems (whatever those are),
  thanks to patch from Robert Millan (rmh(a)debian.org)

o Fixed various crashes and assertion failures related to the new
  ultra_scan() system, that were found by Arturo "Buanzo" Busleiman
  (buanzo(a)buanzo.com.ar), Eric (catastrophe.net), and Bill Petersen
  (bill.petersen(a)alcatel.com).

o Fixed some minor memory leaks relating to ping and list scanning as
  well as the Nmap output table.  These were found with Valgrind (
  http://valgrind.kde.org/ ).

o Provide limited --packet_trace support for TCP connect() (-sT)
  scans.

o Fixed compilation on certain Solaris machines thanks to a patch by
  Tom Duffy (tduffy(a)sun.com)

o Fixed some warnings that crop up when compiling Nbase C files with a
  C++ compiler.  Thanks to Gisle Vanem (giva(a)bgnett.no) for sending
  the patch.

o Tweaked the License blurb on source files and in the man page.  It
  clarifies some issues and includes a new GPL exception that
  explicitly allows linking with the OpenSSL library.  Some people
  believe that the GPL and OpenSSL licenses are incompatible without
  this special exception.

o Fixed some serious runtime portability issues on *BSD systems.
  Thanks to Eric (catastrophe.net) for reporting the problem.

o Changed the argument parser to better detect bogus arguments to the
  -iR option.

o Removed a spurious warning message relating to the Windows ARP cache
  being empty.  Patch by Gisle Vanem (giva(a)bgnett.no).

o Removed some C++-style line comments (//) from nbase, because some C
  compilers (particularly on Solaris) barf on those.  Problem reported
  by Raju Alluri <Raju.Alluri(a)Sun.COM>

Nmap 3.55

o Added MAC address printing.  If Nmap receives packet from a target
  machine which is on an Ethernet segment directly connected to the
  scanning machine, Nmap will print out the target MAC address.  Nmap
  also now contains a database (derived from the official IEEE
  version) which it uses to determine the vendor name of the target
  ethernet interface.  The Windows version of Nmap does not yet have
  this capability.  If any Windows developer types are interesting in
  adding it, you just need to implement IPisDirectlyConnected() in
  tcpip.cc and then please send me the patch.  Here are examples from
  normal and XML output (angle brackets replaced with [] for HTML
  changelog compatibility):
  MAC Address: 08:00:20:8F:6B:2F (SUN Microsystems)
  [address addr="00:A0:CC:63:85:4B" vendor="Lite-on Communications" addrtype="mac" /]

o Updated the XML DTD to support the newly printed MAC addresses.
  Thanks to Thorsten Holz (thorsten.holz(a)mmweg.rwth-aachen.de) for
  sending this patch.

o Added a bunch of new and fixed service fingerprints for version
  detection.  These are from Martin Macok
  (martin.macok(a)underground.cz).

o Normalized many of the OS names in nmap-os-fingerprints (fixed
  capitalization, typos, etc.).  Thanks to Royce Williams
  (royce(a)alaska.net) and Ping Huang (pshuang(a)alum.mit.edu) for
  sending patches.

o Modified the mswine32/nmap_performance.reg Windows registry file to
  use an older and more compatible version.  It also now includes the
  value "StrictTimeWaitSeqCheck"=dword:00000001 , as suggested by Jim
  Harrison (jmharr(a)microsoft.com).  Without that latter value, the
  TcpTimedWaitDelay value apparently isn't checked.  Windows users
  should apply the new registry changes by clicking on the .reg file.
  Or do it manually as described in README-WIN32.  This file is also
  now available in the data directory at
  http://www.insecure.org/nmap/data/nmap_performance.reg

o Applied patch from Gisle Vanem (giva(a)bgnett.no) which allows the
  Windows version of Nmap to work with WinPCAP 3.1BETA (and probably
  future releases).  The Winpcap folks apparently changed the encoding
  of adapter names in this release.

o Fixed a ping scanning bug that would cause this error message: "nmap:
  targets.cc:196: int hostupdate (Target **, Target *, int, int, int,
  timeout_info *, timeval *, timeval *, pingtune *, tcpqueryinfo *,
  pingstyle): Assertion `pt->down_this_block > 0' failed."  Thanks to
  Beirne Konarski (beirne(a)neo.rr.com) for reporting the problem.

o If a user attempts -PO (the letter O), print an error suggesting
  that they probably mean -P0 (Zero) to disable ping scanning.

o Applied a couple patches (with minor changes) from Oliver Eikemeier
  (eikemeier(a)fillmore-labs.com) which fix an edge case relating to
  decoy scanning IP ranges that must be sent through different
  interfaces, and improves the Nmap response to certain error codes
  returned by the FreeBSD firewall system.  The patches are from
  http://cvsweb.freebsd.org/ports/security/nmap/files/ .

o Many people have reported this error: "checking for type of 6th
  argument to recvfrom()... configure: error: Cannot find type for 6th
  argument to recvfrom()".  In most cases, the cause was a missing or
  broken C++ compiler.  That should now be detected earlier with a
  clearer message.

o Fixed the FTP bounce scan to better detect filtered ports on the
  target network.

o Fixed some minor bugs related to the new MAC address printing
  feature.

o Fixed a problem with UDP-scanning port 0, which was reported by
  Sebastian Wolfgarten (sebastian(a)wolfgarten.com).

o Applied patch from Ruediger Rissmann (RRI(a)zurich.ibm.com), which
  helps Nmap understand an EACCESS error, which can happen at least
  during IPv6 scans from certain platforms to some firewalled targets.

o Renamed ACK ping scan option from -PT to -PA in the documentation.
  Nmap has accepted both names for years and will continue to do
  so.

o Removed the notice that Nmap is reading target specifications from a
  file or stdin when you specify the -iL option.  It was sometimes
  printed to stdout even when you wanted to redirect XML or grepable
  output there, because it was printed during options processing before
  output files were handled.  This change was suggested by Anders Thulin
  (ath(a)algonet.se).

o Added --source_port as a longer, but hopefully easier to remember,
  alias for -g.  In other words, it tries to use the constant source
  port number you specify for probes.  This can help against poorly
  configured firewalls that trust source port 20, 53, and the like.

o Removed undocumented (and useless) -N option.

o Fixed a version detection crash reported in excellent detail by
  Jedi/Sector One (j(a)pureftpd.org).

o Applied patch from Matt Selsky (selsky(a)columbia.edu) which helps
  Nmap build with OpenSSL.

o Modified the configure/build system to fix library ordering problems
  that prevented Nmap from building on certain platforms.  Thanks to
  Greg A. Woods (woods(a)weird.com) and Saravanan
  (saravanan_kovai(a)HotPop.com) for the suggestions.

o Applied a patch to Makefile.in from Scott Mansfield
  (thephantom(a)mac.com) which enables the use of a DESTDIR variable
  to install the whole Nmap directory structure under a different root
  directory.  The configure --prefix option would do the same thing in
  this case, but DESTDIR is apparently a standard that package
  maintainers like Scott are used to.  An example usage is 
  "make DESTDIR=/tmp/packageroot".

o Removed unnecessary banner printing in the non-root connect() ping
  scan.  Thanks to Tom Rune Flo (tom(a)x86.no) for the suggestion and
  a patch.

o Updated the headers at the top of each source file (mostly to
  advance the copyright year to 2004 and note that Nmap is a registered
  trademark).

o The SInfo line of submitted fingerprints now provides the target's
  OUI (first three bytes of the MAC address) if available.  Example:
  "M=00A0CC".  To save a couple bytes, the "Time" field in SInfo has
  been renamed to "Tm".  The OUI helps identify the device vendor, and
  is only available when the source and target machines are on the
  same ethernet network.

Nmap 3.50

o Integrated a ton of service fingerprints, increasing the number of
  signatures more than 50%.  It has now exceeded 1,000 for the first
  time, and represents 180 unique service protocols from acap, afp,
  and aim to xml-rpc, zebedee, and zebra.

o Implemented a huge OS fingerprint update.  The number of
  fingerprints has increased more than 13% to 1,121.  This is the first
  time it has exceeded 1000.  Notable updates include Linux 2.6.0, Mac
  OS X up to 10.3.2 (Panther), OpenBSD 3.4 (normal and pf "scrub all"),
  FreeBSD 5.2, the latest Windows Longhorn warez, and Cisco PIX 6.3.3.
  As usual, there are a ton of new consumer devices from ubiquitous
  D-Link, Linksys, and Netgear broadband routers to a number of new IP
  phones including the Cisco devices commonly used by Vonage.  Linksys
  has apparently gone special-purpose with some of their devices, such
  as their WGA54G "Wireless Game Adapter" and WPS54GU2 wireless print
  server.  A cute little MP3 player called the Rio Karma was submitted
  multiple times and I also received and integrated fingerprints for the
  Handspring Treo 600 (PalmOS).

o Applied some man page fixes from Eric S. Raymond
  (esr(a)snark.thyrsus.com).

o Added version scan information to grepable output between the last
  two '/' delimiters (that space was previously unused).  So the format
  is now "portnum/state/protocol/owner/servicename/rpcinfo/versioninfo"
  as in "53/open/tcp//domain//ISC Bind 9.2.1/" and
  "22/open/tcp//ssh//OpenSSH 3.5p1 (protocol 1.99)/".  Thanks to
  MadHat (madhat(a)unspecific.com) for sending a patch (although I did
  it differently).  Note that any '/' characters in the
  version (or owner) field are replaced with '|' to keep awk/cut
  parsing simple.  The service name field has been updated so that it
  is the same as in normal output (except for the same sort of
  escaping discussed above).

o Integrated an Oracle TNS service probe and match lines contributed
  by Frank Berger (fm.berger(a)gmx.de).  New probe contributions are
  always appreciated!

o Fixed a crash that could happen during SSL version detection due to
  SSL session ID cache reference counting issues.

o Applied patch from Rob Foehl (rwf(a)loonybin.net) which fixes the
  --with_openssl=DIR configure argument.

o Applied patch to nmap XML dtd (nmap.dtd) from Mario Manno
  (mm(a)koeln.ccc.de).  This accounts for the new version scanning
  functionality.

o Updated the Windows build system so that you don't have to manually
  copy nmap-service-probes to the output directory.  I also updated
  the README-WIN32 to elaborate further on the build process.

o Added configure option --with-libpcre=included which causes Nmap to
  build with its included version of libpcre even if an acceptable
  version is available on the system.

o Upgraded to Autoconf 2.59 (from 2.57).  This should help HP-UX
  compilation problems reported by Petter Reinholdtsen
  (pere(a)hungry.com) and may have other benefits as well.

o Applied patch from Przemek Galczewski (sako(a)avet.com.pl) which
  adds spaces to the XML output in places that apparently help certain
  older XML parsers.

o Made Ident-scan (-I) limits on the length and type of responses
  stricter so that rogue servers can't flood your screen with 1024
  characters.  The new length limit is 32.  Thanks to Tom Rune Flo
  (tom(a)x86.no) for the suggestion and a patch.

o Fingerprints for unrecognized services can now be a bit longer to
  avoid truncating as much useful response information.  While the
  fingerprints can be longer now, I hope they will be less frequent
  because of all the newly recognized services in this version.

o The nmap-service-probes "match" directive can now take a service
  name like "ssl/vmware-auth".  The service will then be reported as
  vmware-auth (or whatever follows "ssl/") tunneled by SSL, yet Nmap
  won't actually bother initiating an SSL connection.  This is useful
  for SSL services which can be fully recognized without the overhead
  of making an SSL connection.

o Version scan now chops commas and whitespace from the end of
  vendorproductname, version, and info fields.  This makes it easier to
  write templates incorporating lists.  For example, the tcpmux service
  (TCP port 1) gives a list of supported services separated by CRLF.
  Nmap uses this new feature to print them comma separated without
  having an annoying trailing comma as so (linewrapped):
  match tcpmux m|^(sgi_[-.\w]+\r\n([-.\w]+\r\n)*)$| 
        v/SGI IRIX tcpmux//Available services: $SUBST(1, "\r\n", ",")/

Nmap 3.48

o Integrated an enormous number of version detection service
  submissions.  The database has almost doubled in size to 663
  signatures representing the following 130 services: 
    3dm-http afp apcnisd arkstats bittorent chargen citrix-ica
    cvspserver cvsup dantzretrospect daytime dict directconnect domain
    echo eggdrop exec finger flexlm font-service ftp ftp-proxy gnats
    gnutella-http hddtemp hp-gsg http http-proxy hylafax icecast ident
    imap imaps imsp ipp irc ircbot irc-proxy issrealsecure jabber
    kazaa-http kerberos-sec landesk-rc ldap linuxconf lmtp lotusnotes
    lpd lucent-fwadm meetingmaker melange microsoft-ds microsoft-rdp
    mldonkey msactivesync msdtc msrpc ms-sql-m mstask mud mysql
    napster ncacn_http ncp netbios-ns netbios-ssn netrek netsaint
    netstat netwareip networkaudio nntp nsclient nsunicast ntop-http
    omniback oracle-mts oracle-tns pcanywheredata pksd pmud pop2 pop3
    pop3s poppass postgresql powerchute printer qotd redcarpet
    rendezvous rlogind rpc rsync rtsp sdmsvc sftp shell shivahose
    sieve slimp3 smtp smux snpp sourceoffice spamd ssc-agent ssh ssl
    svrloc symantec-av symantec-esm systat telnet time tinyfw upnp
    uucp veritasnetbackup vnc vnc-http vtun webster whois wins
    winshell wms X11 xfce zebra

o Added the ability to execute "helper functions" in version
  templates, to help clean up/manipulate data captured from a server
  response.  The first defined function is P() which includes only
  printable characters in a captured string.  The main impetus for
  this is to deal with Unicode strings like
  "W\0O\0R\0K\0G\0R\0O\0U\0P\0" that many MS protocols send.  Nmap can
  now decode that into "WORKGROUP".

o Added SUBST() helper function, which replaces strings in matched
  appname/version/extrainfo strings with something else.  For example,
  VanDyke Vshell gives a banner that includes
  "SSH-2\.0-VShell_2_2_0_528".  A substring match is used to pick out
  the string "2_2_0_528", and then SUB21ST(1,"_",".") is called on that
  match to form the version number 2.2.0.528.

o If responses to a probe fail to match any of the registered match
  strings for that probe, Nmap will now try against the registered "null
  probe" match strings.  This helps in the case that the NULL probe
  initially times out (perhaps because of initial DNS lookup) but the
  banner appears in later responses.

o Applied some portability fixes (particularly for OpenBSD) from Chad
  Loder (cloder(a)loder.us), who is also now the OpenBSD Nmap port
  maintainer.

o Applied some portability fixes from Marius Strobl
  (marius(a)alchemy.franken.de).

o The tarball distribution of Nmap now strips the binary at install
  time thanks to a patch from Marius Strobl
  (marius(a)alchemy.franken.de).

o Fixed a problem related to building Nmap on systems that lack PCRE
  libs (and thus have to use the ones included by Nmap).  Thanks to Remi
  Denis-Courmont (deniscr6(a)cti.ecp.fr) for the report and patch.

o Alphabetized the service names in each Probe section in
  nmap-service-probes (makes them easier to find and add to).

o Fixed the problem several people reported where Nmap would quit with
  a "broken pipe" error during service scanning.  Thanks to Jari Ruusu
  (jari.ruusu(a)pp.inet.fi) for sending a patch.  The actual error
  message was "Unexpected error in NSE_TYPE_READ callback.  Error
  code: 32 (Broken pipe)"

o Fixed protocol scan (-sO), which I had broken when adding the new
  output table format.  It would complain "NmapOutputTable.cc:128:
  failed assertion `row < numRows'".  Thanks to Matt Burnett
  (marukka(a)mac.com) for notifying me of the problem.

o Upgraded Libpcap to the latest tcpdump.org version (0.7.2) from
  0.7.1

o Applied a patch from Peter Marschall (peter(a)adpm.de) which adds
  version detection support to nmapfe.

o Fixed a problem with XML output being invalid when service detection
  was done on SSL-tunneled ports.  Thanks to the several people who
  reported this - it means that folks are actually using the XML
  output :).

o Fixed (I hope) some Solaris Sun ONE compiler compilation problems
  reported (w/patches) by Mikael Mannstrom (candyman(a)penti.org)

o Fixed the --with-openssl configure option for people who have
  OpenSSL installed in a path not automatically found by their
  compilers.  Thanks to  Marius Strobl (marius(a)alchemy.franken.de) for
  the patch.

o Made some portability changes for HP-UX and possibly other types of
  machines, thanks to a patch from Petter Reinholdtsen (pere(a)hungry.com)

o Applied a patch from Matt Selsky (selsky(a)columbia.edu) which fixes
  compilation on some Solaris boxes, and maybe others.  The error said
  "cannot compute sizeof (char)"

o Applied some patches from the NetBSD ports tree that Hubert Feyrer
  (hubert.feyrer(a)informatik.fh-regensburg.de) sent me.  The NetBSD
  Nmap ports page is at http://www.NetBSD.org/packages/net/nmap/ .

o Applied some Makefile patches from the FreeBSD ports tree that I
  found at http://www.freebsd.org/cgi/cvsweb.cgi/ports/security/nmap/files/

Nmap 3.45

o Integrated more service signatures from MadHat
  (madhat(a)unspecific.com), Brian Hatch (bri(a)ifokr.org), Niels
  Heinen (zillion(a)safemode.org), Solar Designer
  (solar(a)openwall.com), Seth Master
  (smaster(a)stanford.edu), and Curt Wilson
  (netw3_security(a)hushmail.com).  We now have 378 signatures
  recognizing 86 unique service protocols.

o Added new HTTPOptions and RTSPRequest probes suggested by MadHat
  (madhat(a)unspecific.com)

o Changed the .spec file to compile Nmap RPMs without SSL support to
  improve compatibility (Some users might not have OpenSSL, and even
  those who do might not have the right version (libopenssl.so.2 vs
  libopenssl.so.4, etc).

o Applied a patch from Solar Eclipse (solareclipse(a)phreedom.org)
  which increases the allowed size of the 'extrainfo' version field from
  80 characters to 128.  The main benefit is to allow longer apache module
  version strings.

o Fixed Windows compilation and improved the Windows port slightly (no
  more macro to redefine read().

o Applied some updates to README-WIN32 sent in by Kirby Kuehl
  (kkuehl(a)cisco.com).  He improved the list of suggested registry
  changes and also fixed a typo or two.  He also attached a .reg file
  automate the Nmap connect() scan performance enhancing registry
  changes.  I am now including that with the Nmap Windows binary .zip
  distribution (and in mswin32/ of the source distro).

o Applied a one-line patch from Dmitry V. Levin (ldv(a)altlinux.org)
  which fixes a test Nmap does during compilation to see if an existing
  libpcap installation is recent enough.

Nmap 3.40PVT17

o Wrote and posted a new paper on version scanning to
  http://www.insecure.org/nmap/versionscan.html .  Updated
  nmap-service-probes and the Nmap man page to simply refer to this
  URL.

o Integrated more service signatures from my own scanning as well as
  contributions from Brian Hatch (bri(a)ifokr.org), MadHat
  (madhat(a)unspecific.com), Max Vision (vision(a)whitehats.com), HD
  Moore (hdm(a)digitaloffense.net), Seth Master
  (smaster(a)stanford.edu), and Niels Heinen (zillion(a)safemode.org).
  MadHat also contributed a new probe for Windows Media Service.  Many
  people set a LOT of signatures, which has allowed
  nmap-service-probes to grow from 295 to 356 signatures representing
  85 service protocols!

o Applied a patch (with slight changes) from Brian Hatch
  (bri(a)ifokr.org) which enables caching of SSL sessions so that
  negotiation doesn't have to be repeated when Nmap reconnects to the same
  between probes.

o Applied a patch from Brian Hatch (bri(a)ifokr.org) which optimizes the
  requested SSL ciphers for speed rather than security.  The list was
  based on empirical evidence from substantial benchmarking he did with
  tests that resemble nmap-service-scanning.

o Updated the Nmap man page to discuss the new version scanning
  options (-sV, -A).

o I now include nmap-version/aclocal.m4 in the distribution as this is
  required to rebuild the configure script ( thanks to Dmitry V. Levin
  (ldv(a)altlinux.org) for notifying me of the problem.

o Applied a patch from Dmitry V. Levin (ldv(a)altlinux.org) which
  detects whether the PCRE include file is <pcre.h> or <pcre

o Applied a patch from Dmitry V. Levin (ldv(a)altlinux.org) which
  fixes typos in some error messages.  The patch apparently came from
  the highly-secure and stable Owl and Alt Linux distributions.  Check
  them out at http://www.openwall.com/Owl/ and
  http://www.altlinux.com/

o Fixed compilation on Mac OS X - thanks to Brian Hatch
  (bri(a)ifokr.org> and Ryan Lowe (rlowe(a)pablowe.net) for giving me
  access to Mac OS X boxes.

o Stripped down libpcre build system to remove libtool dependency and
  other cruft that Nmap doesn't need. (this was mostly a response to
  libtool-related issues on Mac OS X).

o Added a new --version_trace option which causes Nmap to print out extensive
  debugging info about what version scanning is doing (this is a subset
  of what you would get with --packet_trace).  You should usually use
  this in combination with at least one -d option.

o Fixed a port number printing bug that would cause Nmap service
  fingerprints to give a negative port number when the actual port was
  above 32K.  Thanks to Seth Master (smaster(a)stanford.edu) for finding
  this.

o Updated all the header text again to clarify our interpretation of
  "derived works" after some suggestions from Brian Hatch
  (bri(a)ifokr.org)

o Updated the Nsock config.sub/config.guess to the same newer versions
  that Nmap uses (for Mac OS X compilation).

Nmap 3.40PVT16

o Fixed a compilation problem on systems w/o OpenSSL that was
  discovered by Solar Designer.  I also fixed some compilation
  problems on non-IPv6 systems.  It now compiles and runs on my
  Solaris and ancient OpenBSD systems.

o Integrated more services thanks to submissions from Niels Heinen
  (zillion(a)safemode.org).

o Canonicalized the headers at the top of each Nmap/Nsock header source
  file.  This included clarifying our interpretation of derived works,
  updating the copyright date to 2003, making the header a bit wider,
  and a few other light changes.  I've been putting this off for a
  while, because it required editing about a hundred !#$# files!

Nmap 3.40PVT15

o Fixed a major bug in the Nsock time caching system.  This could
  cause service detection to inexplicably fail against certain ports in
  the second or later machines scanned.  Thanks to Solar Designer and HD
  Moore for helping me track this down.

o Fixed some *BSD compilation bugs found by 
  Zillion (zillion(a)safemode.org).

o Integrated more services thanks to submissions from Fyodor Yarochkin
  (fygrave(a)tigerteam.net), and Niels Heinen
  (zillion(a)safemode.org), and some of my own exploring.  There are
  now 295 signatures.

o Fixed a compilation bug found by Solar Designer on machines that
  don't have struct sockaddr_storage.  Nsock now just uses "struct
  sockaddr *" like connect() does.

o Fixed a bug found by Solar Designer which would cause the Nmap
  portscan table to be truncated in -oN output files if the results are
  very long.

o Changed a bunch of large stack arrays (e.g. int portlookup[65536])
  into dynamically allocated heap pointers.  The large stack variables
  apparently caused problems on some architectures.  This issue was
  reported by osamah abuoun (osamah_abuoun(a)hotmail.com).

Nmap 3.40PVT14

o Added IPv6 support for service scan.

o Added an 'sslports' directive to nmap-service-probes.  This tells
  Nmap which service checks to try first for SSL-wrapped ports.  The
  syntax is the same as the normal 'ports' directive for non-ssl ports.
  For example, the HTTP probe has an 'sslports 443' line and
  SMTP-detecting probes have and 'sslports 465' line.

o Integrated more services thanks to submissions from MadHat
  (madhat(a)unspecific.com), Solar Designer (solar(a)openwall.com), Dug
  Song (dugsong(a)monkey.org), pope(a)undersec.com, and Brian Hatch
  (bri(a)ifokr.org).  There are now 288 signatures, matching these 65
  service protocols:
    chargen cvspserver daytime domain echo exec finger font-service
    ftp ftp-proxy http http-proxy hylafax ident ident imap imaps ipp
    ircbot ircd irc-proxy issrealsecure landesk-rc ldap meetingmaker
    microsoft-ds msrpc mud mysql ncacn_http ncp netbios-ns netbios-ssn
    netsaint netwareip nntp nsclient oracle-tns pcanywheredata pop3
    pop3s postgres printer qotd redcarpet rlogind rpc rsync rtsp shell
    smtp snpp spamd ssc-agent ssh ssl telnet time upnp uucp vnc
    vnc-http webster whois winshell X11

o Added a Lotus Notes probe from Fyodor Yarochkin
  (fygrave(a)tigerteam.net).

o Dug Song wins the "award" for most obscure service fingerprint
  submission.  Nmap now detects Dave Curry's Webster dictionary server
  from 1986 :).

o Service fingerprints now include a 'T=SSL' attribute when SSL
  tunneling was used.

o More portability enhancements thanks to Solar Designer and his Linux
  2.0 libc5 boxes.

o Applied a patch from Gisle Vanem (giva(a)bgnett.no) which improves
  Windows emulation of the UNIX mmap() and munmap() memory mapping calls.

Nmap 3.40PVT13

o Added SSL-scan-through support.  If service detection finds a port to be
  SSL, it will transparently connect to the port using OpenSSL and use
  version detection to determine what service lies beneath.  This
  feature is only enabled if OpenSSL is available at build time.  A
  new --with-openssl=DIR configure option is available if OpenSSL is
  not in your default compiler paths.  You can use --without-openssl
  to disable this functionality.  Thanks to Brian Hatch
  (bri(a)ifokr.org) for sample code and other assistance.  Make sure
  you use a version without known exploitable overflows.  In
  particular, versions up to and including OpenSSL 0.9.6d and
  0.9.7-beta2 contained serious vulnerabilities described at
  http://www.openssl.org/news/secadv_20020730.txt .  Note that these
  vulnerabilities are well over a year old at the time of this
  writing.

o Integrated many more services thanks to submissions from Brian
  Hatch, HellNBack ( hellnbak(a)nmrc.org ), MadHat, Solar Designer,
  Simple Nomad, and Shawn Wallis (swallis(a)ku.edu).  The number of
  signatures has grown from 242 to 271.  Thanks!

o Integrated Novell Netware NCP and MS Terminal Server probes from
  Simple Nomad (thegnome(a)nmrc.org).

o Fixed a segfault found by Solar Designer that could occur when
  scanning certain "evil" services.

o Fixed a problem reported by Solar Designer and MadHat (
  madhat(a)unspecific.com ) where Nmap would bail when certain Apache
  version/info responses were particularly long.  It could happen in
  other cases as well.  Now Nmap just prints a warning.

o Fixed some portability issues reported by Solar Designer 
  ( solar(a)openwall.com )

Nmap 3.40PVT12

o I added probes for SSL (session startup request) and microsoft-ds
  (SMB Negotiate Protocol request).

o I changed the default read timeout for a service probe from 7.5s to 5s.

o Fixed a one-character bug that broke many scans when -sV was NOT
  given.  Thanks to Blue Boar (BlueBoar(a)thievco.com) for the report.

Nmap 3.40PVT11

o Integrated many more services thanks to submissions from Simple
  Nomad, Solar Designer, jerickson(a)inphonic.com, Curt Wilson, and
  Marco Ivaldi.  Thanks!  The match line count has risen from 201 to 242.

o Implemented a service classification scheme to separate the
  vendor/product name from the version number and any extra info that
  is provided.  Instead of v/[big version string]/, the new match
  lines include v/[vendor/productname]/[version]/[extrainfo]/ .  See
  the docs at the top of nmap-service-probes for more info.  This
  doesn't change the normal output (which lumps them together anyway),
  but they are separate in the XML so that higher-level programs can
  easily match against just a product name.  Here are a few examples
  of the improved service element:
  <service name="ssh" product="OpenSSH" version="3.1p1"
     extrainfo="protocol 1.99" method="probed" conf="10" />
  <service name="domain" product="ISC Bind" version="9.2.1"
     method="probed" conf="10" />
  <state state="open" /><service name="rpcbind" version="2"
     extrainfo="rpc #100000" method="probed" conf="10" />
  <service name="rndc" method="table" conf="3" />

o I went through nmap-service-probes and added the vendor name to more
  entries.  I also added the service name where the product name
  itself didn't make that completely obvious.

o SCO Corporation of Lindon, Utah (formerly Caldera) has lately taken
  to an extortion campaign of demanding license fees from Linux users
  for code that they themselves knowingly distributed under the terms
  of the GNU GPL.  They have also refused to accept the GPL, claiming
  that some preposterous theory of theirs makes it invalid.  Meanwhile
  they have distributed GPL-licensed Nmap in (at least) their
  "Supplemental Open Source CD".  In response to these blatant
  violations, and in accordance with section 4 of the GPL, we hereby
  terminate SCO's rights to redistribute any versions of Nmap in any
  of their products, including (without limitation) OpenLinux,
  Skunkware, OpenServer, and UNIXWare.

Nmap 3.40PVT10

o Added "soft matches".  These are similar to normal match lines in
  that they provide a regex for recognizing a service (but no version).
  But instead of stopping at softmatch service recognition, the scan
  continues looking for more info.  It only launches probes that are
  known-capable of matching the softmatched service.  If no version
  number is found, at least the determined service is printed.  A
  service print for submission is also provided in that case.  So this
  provides more informative results and improves efficiency.

o Cleaned up the Windows support a bit and did more testing and
  fixing.  Windows service detection seems to be working fine for me
  now, although my testing is still pretty limited.  This release
  includes a Windows binary distribution and the README-WIN32 has been
  updated to reflect new compilation instructions.

o More service fingerprints!  Thanks to Solar Designer, Max Vision,
  Frank Denis (Jedi/Sector One) for the submissions.  I also added a
  bunch from my own testing. The number of match lines went from 179
  to 201.

o Updated XML output to handle new version and service detection
  information.  Here are a few examples of the new output:
  <port protocol="tcp" portid="22"><state state="open" /><service
    name="ssh" version="OpenSSH 3.1p1 (protocol 1.99)" method="probed"
    conf="10" /></port>
  <port protocol="tcp" portid="111"><state state="open" /><service
    name="rpcbind" version="2 (rpc #100000)" method="probed" conf="10" /></port>
  <port protocol="tcp" portid="953"><state state="open" /><service
    name="rndc" method="table" conf="3" /></port>

o Fixed issue where Nmap would quit when ECONNREFUSED was returned
  when we try to read from an already-connected TCP socket.  FreeBSD
  does this for some reason instead of giving ECONNRESET.  Thanks to
  Will Saxon (WillS(a)housing.ufl.edu) for the report.

o Removed the SERVICEMATCH_STATIC match type from
  nmap-service-probes.  There wasn't much benefit of this over regular
  expressions, so it isn't worth maintaining the extra code.

Nmap 3.40PVT9

o Added/fixed numerous service fingerprints thanks to submissions from
  Max Vision, MadHat, Seth Master.  Match lines went
  from 164 to 179.

o The Winpcap libraries used in the Windows build process have been
  upgraded to version 3.0.

o Most of the Windows port is complete.  It compiles and service scan
  works (I didn't test very deeply) on my WinXP box with VS.Net 2003.
  I try to work out remaining kinks and do some cleanup for the next
  version.  The Windows code was restructured and improved quite a bit,
  but much more work remains to be done in that area.  I'll probably
  do a Windows binary .zip release of the next version.

o Various minor fixes

Nmap 3.40PVT8

o Service scan is now OFF by default.  You can activate it with -sV.
  Or use the snazzy new -A (for "All recommended features" or
  "Aggressive") option which turns on both OS detection and service
  detection.

o Fixed compilation on my ancient OpenBSD 2.3 machine (a Pentium 60 :)

o Added/fixed numerous service fingerprints thanks to submissions from
  Brian Hatch, HD Moore, Anand R., and some of my own testing.  The
  number of match lines in this version grows from 137 to 164!  Please
  keep 'em coming!

o Various important and not-so-important fixes for bugs I encountered
  while test scanning.

o The RPC grinder no longer prints a startup message if it has no
  RPC-detected ports to scan.

o Some of the service fingerprint length limitations are relaxed a bit
  if you enable debugging (-d).

Nmap 3.40PVT7

o Added a whole bunch of services submitted by Brian Hatch
  (bri(a)ifokr.org).  I also added a few Windows-related probes.
  Nmap-service-probes has gone from 101 match strings to 137.  Please
  keep the submissions coming.

o The question mark now only appears for ports in the OPEN state and
  when service detection was requested.

o I now print a separator bar between service fingerprints when Nmap
  prints more than one for a given host so that users understand to
  submit them individually (suggested by Brian Hatch (bri(a)ifokr.org))

o Fixed a bug that would cause Nmap to print "empty" service
  fingerprints consisting of just a semi-colon.  Thanks to Brian Hatch
  (bri(a)ifokr.org) for reporting this.

Nmap 3.40PVT6

o Banner-scanned hundreds of thousands of machines for ports
  21,23,25,110,3306 to collect default banners.  Where the banner made
  the service name/version obvious, I integrated them into
  nmap-service-probes.  This increased the number of 'match' lines from
  27 to more than 100.

o Created the service fingerprint submission page at
  http://www.insecure.org/cgi-bin/servicefp-submit.cgi

o Changed the service fingerprint format slightly for easier
  processing by scripts.

o Applied a large portability patch from Albert Chin-A-Young
  (china(a)thewrittenword.com).  This cleans up a number of things,
  particularly for IRIX, Tru64, and Solaris.

o Applied NmapFE patch from Peter Marschall (peter(a)adpm.de) which
  "makes sure changes in the relay host and scanned port entry fields
  are displayed immediately, and also keeps the fields editable after
  de- and reactivating them."

Nmap 3.40PVT4

o Limited the size of service fingerprints to roughly 1024 bytes.
  This was suggested by Niels Heinen (niels(a)heinen.ws), because the previous
  limit was excessive.  The number of fingerprints printed is also now
  limited to 10.

o Fixed a segmentation fault that could occur when ping-scanning large
  networks.

o Fixed service scan to gracefully handle host_timeout occurrences when
  they happen during a service scan.

o Fixed a service_scan bug that would cause an error when hosts send
  data and then close() during the NULL probe (when we haven't sent
  anything).

o Applied a patch from Solar Designer (solar(a)openwall.com) which
  corrects some errors in the Russian man page translation and also a
  couple typos in the regular man page.  Then I spell-checked the man
  page to reduce future instances of foreigners sending in diffs to
  correct my English :).

Nmap 3.40PVT3

o Nmap now prints a "service fingerprint" for services that it is
  unable to match despite returning data.  The web submission page it
  references is not yet available.

o Service detection now does RPC grinding on ports it detects to be
  running RPC.

o Fixed a bug that would cause Nmap to quit with an Nsock error when
  --host_timeout was used (or when -T5 was used, which sets it
  implicitly).

o Fixed a bug that would cause Nmap to fail to print the OS
  fingerprint in certain cases.  Thanks to Ste Jones
  (root(a)networkpenetration.com) for the problem report.

Nmap 3.40PVT2

o Nmap now has a simple VERSION detection scheme.  The 'match' lines in
  nmap-service-probes can specify a template version string
  (referencing subexpression matches from the regex in a Perl-like
  manner) so that the version is determined at the same time as the
  service.  This handles many common services in a highly efficient
  manner.  A more complex form of version detection (that initiates
  further communication w/the target service) may be necessary
  eventually to handle services that aren't as forthcoming with
  version details.

o The Nmap port state table now wastes less whitespace due to using a new
  and stingy NmapOutputTable class.  This makes it easier to read, and
  also leaves more room for version info and possibly other enhancements.

o Added 's' option to match lines in nmap-service-probes.  Just as
  with the Perl 's' option, this one causes '.' in the regular
  expression to match any character INCLUDING newline.

o The WinPcap header timestamp is no longer used on Windows as it
  sometimes can be a couple seconds different than gettimeofday() (which
  is really _ftime() on Windows) for some reason.  Thanks to Scott
  Egbert (scott.egbert(a)citigroup.com) for the report.

o Applied a patch by Matt Selsky (selsky(a)columbia.edu) which fixes
  configure.in in such a way that the annoying header file "present but
  cannot be compiled" warning for Solaris.

o Applied another patch from Matt that (we hope) fixes the "present
  but cannot be compiled" warning -- this time for Mac OS X.

o Port table header names are now capitalized ("SERVICE", "PORT", etc)

Nmap 3.40PVT1

o Initial implementation of service detection.  Nmap will now probe
  ports to determine what is listening, rather than guessing based on
  the nmap-services table lookup.  This can be very useful for
  services on unidentified ports and for UDP services where it is not
  always clear (without these probes) whether the port is really open
  or just firewalled.  It is also handy for when services are run on
  the well-known-port of another protocol -- this is happening more
  and more as users try to circumvent increasingly strict firewall
  policies.

o Nmap now uses the excellent libpcre (Perl Compatible Regular
  Expressions) library from http://www.pcre.org/ .  Many systems
  already have this, otherwise Nmap will use the copy it now includes.
  If your libpcre is hidden away in some nonstandard place, give
  ./configure the new --with-libpcre=DIR directive.

o Nmap now uses the C++ Standard Template Library (STL).  This makes
  programming easier, but if it causes major portability or bloat
  problems, I'll reluctantly remove it.

o Applied a patch from Javier Kohen (jkohen(a)coresecurity.com) which
  normalizes the names of many Microsoft entries in the
  nmap-os-fingerprints file.

o Applied a patch by Florin Andrei (florin(a)sgi.com) to the Nmap RPM
  spec file.  This uses the 'Epoch' flag to prevent the Redhat Network
  tool from marking my RPMs as "obsolete" and "upgrading" to earlier
  Redhat-built versions.  A compilation flag problem is also fixed.

Nmap 3.30

o Implemented the largest-ever OS fingerprint update!  Roughly 300
  fingerprints were added/modified.  These massive changes span the
  gamut from AIX 5.1 to the ZyXEL Prestige broadband router line.
  Notable updates include OpenBSD 3.3, FreeBSD 5.1, Mac OS X 10.2.6,
  Windows 2003 server, and more WAPs and broadband routers than you
  can shake a stick at.  Someone even submitted a fingerprint for
  Debian Linux running on the Microsoft Xbox.  You have to love that
  irony :).  Thanks to everyone who submitted fingerprints using the
  URL Nmap gives you when it gets a clean reading but is stumped.  The
  fingerprint DB now contains almost 1000 fingerprints.

o Went through every one of the fingerprints to normalize the
  descriptions a bit.  I also looked up what all of the devices are
  (thanks E*Bay and Google!).  Results like "Nexland ISB Pro800 Turbo"
  and "Siemens 300E Release 6.5" are much more useful when you add the
  words "cable modem" and "business phone system"

o Added a new classification system to nmap-os-fingerprints.  In
  addition to the standard text description, each entry is now
  classified by vendor name (e.g. Sun), underlying OS (e.g. Solaris),
  OS generation (e.g. 7), and device type ("general purpose", router,
  switch, game console, etc).  This can be useful if you want to (say)
  locate and eliminate the SCO systems on a network, or find the
  wireless access points (WAPs) by scanning from the wired side.

o Classification system described above is now used to print out a
  "device type" line and OS categories for matches.  The free-form
  English details are still printed as well.  Nmap can sometimes
  provide classifications even where it used to provide nothing
  because of "too many matches".  These have been added to XML output
  as well.  They are not printed for the "grepable output", as I
  consider that format deprecated.

o Nmap will now sometimes guess in the "no exact matches" case, even
  if you don't use the secret --osscan_guess or -fuzzy options.

o Applied another huge NmapFE patch from Peter Marschall
  (peter(a)adpm.de).  This revamps the interface to use a tabbed
  format that allows for many more Nmap options to be used.  It also
  cleans up some crufty parts of the code.  Let me and Peter know what
  you think (and if you encounter any problems).

o Windows and Amiga ports now use packet receive times from libpcap.
  Let me know if you get any "time computation problem" errors.

o Updated version of the Russian man page translation from Alex Volkov
  (alex(a)cherepovets-city.ru).

Nmap 3.28

o Fixed (I hope) an issue that would cause Nmap to print "Serious time
  computation problem in adjust_timeout ..." and quit.  The ultimate
  cause was demonstrated by this --packet_trace snippet that Russel
  Miller (rmiller(a)duskglow.com) sent me:
  SENT (0.0500s) ICMP 0.0.0.0 > 127.0.0.1 Echo request (type=8/code=0) ...
  RCVD (0.0450s) ICMP 127.0.0.1 > 127.0.0.1 Echo reply (type=0/code=0) ...
  As you can see, the ping reply appears to come BEFORE the request
  was sent(!).  This sort of thing happens on at least Linux and
  Windows.  The send time is obtained from gettimeofday(timeval, NULL),
  while receive time libpcap packet header.  If anyone knows why this
  occurs, or (even better) knows a good way to fix it, let me know.
  For now, I am allowing the response to come up to .05s "before" the
  request.  That is gross.

o For years, Nmap has added -I/usr/local/include and -L/usr/local/lib
  to the compiler line to grab local libraries.  I have removed this
  behavior by default, and added a '--with-localdirs' configure option
  that adds it back.  If Nmap fails to compile now without the above
  option, please let me know.  I can change the default back if this
  change causes more problems than it solves.  People (such as certain
  ports tree packagers) who know they don't want /usr/local should
  specify --without-localdirs rather than relying on that always being
  the default.

o Fixed (I hope) a problem that led to the error message "Assertion
  `tqi->sockets[probe_port_num][seq] == -1' failed".

o Fixed a problem that would cause Nmap on Windows to send ICMP ping
  packets from 0.0.0.0 instead of the appropriate source IP.  Thanks
  to Yeti (boxed(a)blueyonder.co.uk) for the report.

o Applied some changes from Solar Designer (solar(a)openwall.com)
  which fix some typos and also suggest safer /tmp/ behavior in the
  HACKING file and Lithuanian man page.  These changes are for the
  Nmap package of his Openwall GNU/*/Linux (Owl) distribution. 
  [ http://www.openwall.com/Owl/ ]

o For Solaris, I now define NET_SIZE_T to size_t rather than socklen_t
  in nmap.h.  Isn't that exciting?!!!  Hopefully this will help
  compilation on Solaris 2.6 (and perhaps earlier).  If any Solaris
  users notice new compilation problems, please let me know.  Thanks to
  Al Smith (Al.Smith(a)aeschi.ch.eu.org) for reporting the issue.

o Removed an errant getopt() prototype in nbase/getopt.h which should
  hopefully improve compilation on certain Solaris boxes and BSD
  variants.

o SCO operating systems are no longer supported due to their recent
  (and absurd) attacks against Linux and IBM.  Bug reports relating to
  UnixWare will be ignored, or possibly even laughed at derisively.
  Note that I have no reason to believe anyone has ever used Nmap on
  SCO systems.  UnixWare and OpenServer suck.

o Fixed a problem with small --max_parallelism values when non-root ping
  scanning that would cause Nmap to say "sendconnecttcpquery: Could
  not scavenge a free socket!" and quit.  Problem was reported by
  Justin A (justin(a)bouncybouncy.net) as Debian Bug #195463.

o Applied (with a few modifications) a large NmapFE patch from Peter
  Marschall (peter(a)adpm.de).  This patch adds a bunch more scan/ping
  options and cleans up some redundant NmapFE code.

o Included new Russian man page translation by Alex Volkov
  (alex(a)cherepovets-city.ru)

o Changed many single-quotes (') into double quotes (") in the man
  page due to a disagreement over whether to represent them as (') or
  (\') in nroff.

o Included --packet_trace support for Explicit Congestion Notification
  (RFC 2481/3168) flags thanks to a patch sent in by Maik Pfeil
  (root(a)bundesspionageministerium.de)

o Included --packet_trace support for a few (unusual) ICMP types in
  case Nmap receives them.  The patch was also sent by Maik Pfeil.

o Fixed a problem with redirecting XML/Grep/Machine output to stdout
  on Windows (e.g. -oX - ).  Problem was reported by Wei Jiang
  (Wei.Jiang(a)bindview.com)

o Made "-g -Wall" compiler flags dependent on availability of gcc/g++
  sine some other compilers do not support them.

o I spam-protected the email addresses in this file.  I fervently hope
  that within 5 years we will be able to defeat this scourge through
  technology and laws, so that we may again list our email addresses
  openly without fear of abuse by criminal spammers.  Oh, and it would
  be a shame if the spiders went through this whole page and only
  found uce@ftc.gov, rhundt@fcc.gov, jquello@fcc.gov, sness@fcc.gov,
  president@whitehouse.gov, haesslich@loyalty.org, and rchong@fcc.gov.

Nmap 3.27

o Nmap now compiles under Amiga thanks to patches sent by Diego
  Casorran (dcr8520(a)amiga.org).

o Fixed a backwards WIN32 ifdef that broke UDP and small-fragment
  scans for some operating systems other than Linux and Windows.
  Thanks to Guido van Rooij (guido(a)gvr.org) for reporting the problem
  and sending a patch.

o Applied patch from Marius Strobl (marius(a)alchemy.franken.de) which improves
  the definition of NET_SIZE_T on FreeBSD so that it compiles on
  64-bit platforms.

Nmap 3.26

o Fixed Mac OS X Compilation (at least on most of the machines
  tested).  You will probably need to type 
  "./configure CPP=/usr/bin/cpp" instead of simply "./configure".  If
  you still have trouble, drop me an email.  Thanks to everyone who
  provided or offered shell accounts!

o Fixed a segmentation fault several people reported that was
  introduced in 3.25.  This problem manifests itself intermittently
  in many normal situations involving large-network scanning.  So all
  3.25 users are urged to upgrade.  Pre-3.25 users should upgrade too,
  since 3.25 included so many improvements :).

Nmap 3.25

o I added UDP-based "ping" scanning.  The -PU option can take an
  optional portlist like the TCP "ping" options (-PS, -PA), but it sends
  a UDP packet to the targets and expects hosts that are up to reply
  with a port unreachable (or possibly a UDP response if the port is
  open).  This one is likely to work best against closed ports, since
  many open ports don't respond to empty requests.

o Fixed (I hope) problem where Nmap would abort, complaining that
  "Assertion `pt->down_this_block > 0' failed".  Thanks to
  ray(a)24hoursecurity.org and mugz(a)x-mafia.com for reporting and
  helping me debug this problem.

o Fixed a GCC dependency reported by Ayamura Kikuchi
  (ayamura(a)keio.net)

o Fixed an "assertion failure" which would cause Nmap to exit when you
  specify a --max_rtt_timeout below 3000.  Thanks to Tammy Rathbun
  (rathbun2(a)llnl.gov) and Jan Roger Wilkens (jrw(a)proseq.net) for
  reporting this.

o Packet receive times are now obtained from libpcap rather than
  simply using the time the packets are passed to Nmap.  This should
  improve performance slightly.  I was not able to get this to work
  properly on Windows (either pcap or raw) -- join the nmap-dev list
  if you have ideas.

o Fixed bug that caused Nmap to ignore certain RST responses when you
  do both -PS and -PA.

o Modified ping scan to work better when many instances of Nmap are
  executed concurrently.

o I'm now linking directly to the gzip compressed version of Nmap on
  the homepage as well as the .bz2.

o Fixed a portability problem that caused BSD Make to bail out.

o Fixed a divide by zero error caused when non-root users (on UNIX)
  explicitly request ICMP pings (which require root privileges).  Now it
  prints a warning and uses the normal non-root TCP connect() ping.
  Jaroslav Sladek (jup(a)matfyz.cz) found the bug and provided the patch.

o Made Nmap more tolerant of corrupt nmap-services and nmap-protocols
  files thanks to report & patch sent by Phix (phix(a)hush.com)

o Added some more port numbers sent in by Seth Master
  (smaster(a)stanford.edu).  He has been a frequent nmap-services
  contributor in the last couple months.

o Added --packet_trace support to Windows

o Removed superfluous "addport" line in the XML output (patch from Max
  Schubert (nmap(a)webwizarddesign.com)).

o Merged wintcpip.cc into tcpip.cc to avoid the headache of
  maintaining many nearly-identical functions.

o Fixed an assertion failure crash related to combining port 0 scans
  and OS scan.  Thanks to A.Jones(a)mvv.de for reporting this.

o Fixed some compilation problems on systems without IPv6 support --
  patch sent by Jochen Erwied (Jochen.Erwied(a)mbs-software.info)

o Applied patch from Jochen Erwied (Jochen.Erwied(a)mbs-software.info)
  which fixes the format strings used for printing certain timestamps.

o Upgraded to autoconf 2.57, including the latest config.guess/config.sub

o Renamed configure.ac files to configure.in as recommended by the
  latest autoconf documentation.

o Changed the wording of NmapFE Gnome entries to better-comply with
  Gnome's Human Interface Guidelines (HIG).  Suggested by Axel Krauth
  (krauth(a)fmi.uni-passau.de)

Nmap 3.20

o The random IP input option (-iR) now takes an argument specifying
  how many IPs you want to scan (e.g. -iR 1000).  Specify 0 for the old
  never-ending scan behavior.

o Fixed a tricky memory leak discovered by Mugz (mugz(a)x-mafia.com).

o Fixed output truncation problem noted by Lionel CONS (lionel.cons(a)cern.ch)

o Fixed a bug that would cause certain incoming ICMP error messages to
  be improperly ignored.

Nmap 3.15BETA3

o Made numerous improvements to the timing behavior of "-T Aggressive"
  (same as -T4) scans.  It is now recommended for regular use by
  impatient people with a fast connection.  "-T Insane" mode has also
  been updated, but we only recommend that for, well, insane people.

o Made substantial changes to the SYN/connect()/Window scanning
  algorithms for improved speeds, especially against heavily filtered
  hosts.  If you notice any timing problems (misidentified ports,
  etc.), please send me the details (including full Nmap output and a
  description of what is wrong).  Reports of any timing problems with
  -T4 would be helpful as well.

o Changed Nmap such that ALL syn scan packets are sent from the port
  you specify with -g.  Retransmissions used to utilize successively
  higher ports.  This change has a downside in that some operating
  systems (such as Linux) often won't reply to the retransmissions
  because they reuse the same connection specifier quad
  (srcip:srcport:dstip:dstport).  Overall I think this is a win.

o Added timestamps to "Starting nmap" line and each host port scan in
  verbose (-v) mode.  These are in ISO 8601 standard format because
  unlike President Bush, we actually care about International 
  consensus :).

o Nmap now comes by default in .tar.bz2 format, which compresses about
  20% further.  You can still find .tgz in the dist directory at
  http://download.insecure.org/nmap/dist/?M=D .

o Various other minor bug fixes, new services, fingerprints, etc.

Nmap 3.15BETA2

o I added support for a brand new "port" that many of you may have
  never scanned before!  UDP & TCP "port 0" (and IP protocol 0) are now
  permitted if you specify 0 explicitly.  An argument like "-p -40"
  would still scan ports 1-40.  Unlike ports, protocol 0 IS now scanned
  by default.  This now works for ping probes too (e.g., -PS, -PA).

o Applied patch by Martin Kluge (martin(a)elxsi.info) which adds --ttl
  option, which sets the outgoing IPv4 TTL field in packets sent via
  all raw scan types (including ping scans and OS detection).  The
  patch "should work" on Windows, but hasn't been tested.  A TTL of 0
  is supported, and even tends to work on a LAN:
    14:17:19.474293 192.168.0.42.60214 > 192.168.0.40.135: S 326:326(0) [ttl 0]
    14:17:19.474456 192.168.0.40.135 > 192.168.0.42.60214: S 280:280(0) ack 326 (ttl 128)

o Applied patch by Gabriel L. Somlo ( somlo(a)acns.colostate.edu ) which
  extends the multi-ping-port functionality to nonroot and IPv6
  connect() users.

o I added a new --datadir command line option which allows you to
  specify the highest priority directory for Nmap data files
  nmap-services, nmap-os-fingerprints, and nmap-rpc.  Any files which
  aren't in the given dir, will be searched for in the $NMAPDIR
  environmental variable, ~/nmap/, a compiled in data directory
  (e.g. /usr/share/nmap), and finally the current directory.

o Fixed Windows (VC++ 6) compilation, thanks to patches from Kevin
  Davis (computerguy(a)cfl.rr.com) and Andy Lutomirski
  (luto(a)stanford.edu)

o Included new Latvian man page translation by 
  "miscelerious options" (misc(a)inbox.lv)

o Fixed Solaris compilation when Sun make is used rather than GNU
  make.  Thanks to Tom Duffy (tduffy(a)sun.com) for assistance.

o Applied patch from Stephen Bishop (sbishop(a)idsec.co.uk) which
  prevents certain false-positive responses when Nmap raw TCP ping scans
  are being run in parallel.

o To emphasize the highly professional nature of Nmap, I changed all
  instances of "fucked up" in error message text into "b0rked".

o Fixed a problem with nmap-frontend RPMs that would cause a bogus
  /bin/xnmap link to be created (it should only create
  /usr/bin/xnmap).  Thanks to Juho Schultz
  (juho.schultz(a)astro.helsinki.fi) for reporting the problem.

o I made the maximum number of allowed routes and interfaces allowed
  on the scanning machine dynamic rather than hardcoded #defines of 1024
  and 128.  You never know -- some wacko probably has that many :).

Nmap 3.15BETA1

o Integrated the largest OS fingerprint DB updates ever! Thanks to
  everyone who contributed signatures!  New or substantially modified
  fingerprints included the latest Windows 2K/XP changes, Cisco IOS
  12.2-based routers and PIX 6.3 firewalls, FreeBSD 5.0, AIX 5.1,
  OpenBSD 3.2, Tru64 5.1A, IBM OS/400 V5R1M0, dozens of wireless APs,
  VOIP devices, firewalls, printers, print servers, cable modems,
  webcams, etc.  We've even got some mod-chipped Xbox fingerprints
  now!

o Applied NetBSD portability patch by Darren Reed
  (darrenr(a)reed.wattle.id.au)

o Updated Makefile to better-detect if it can't make nmapfe and
  provide a clearer error message.  Also fixed a couple compiler
  warnings on some *BSD platforms.

o Applied patch from "Max" (nmap(a)webwizarddesign.com) which adds the
  port owner to the "addport" XML output lines which are printed (only
  in verbose mode, I think) as each open port is discovered.

o I killed the annoying whitespace that is normally appended after the
  service name.  Now it is only there when an owner was found via -sI
  (in which case there is a fourth column and so "service" must be
  exactly 24 characters).

Nmap 3.10ALPHA9

o Reworked the "ping scan" algorithm (used for any scan except -P0 or
  -sL) to be more robust in the face of low-bandwidth and congested
  connections.  This also improves reliability in the multi-port and
  multi-type ping cases described below.

o "Ping types" are no longer exclusive -- you can now do combinations
  such as "-PS22,53,80 -PT113 -PN -PE" in order to increase your odds of
  passing through strict filters.  The "PB" flag is now deprecated
  since you can achieve the same result via "PE" and "PT" options.

o Applied patch (with modest changes) by Gabriel L. Somlo
  (somlo(a)acns.colostate.edu), which allows multiple TCP probe ports in
  raw (root) mode.  See the previous item for an example.

o Fixed a libpcap compilation issue noted by Josef 'Jupp' Schugt
  (deusxmachina(a)webmail.co.za) which relates to the definition (or
  lack thereof) of ARPHRD_HDLC (used for Cisco HDLC frames).

o Tweaked the version number (-V) output slightly.

Nmap 3.10ALPHA7

o Upgraded libpcap from version 0.6.2 to 0.7.1.  Updated the
  libpcap-possiblymodified/NMAP_MODIFICATIONS file to give a much
  more extensive list (including diffs) of the changes included
  in the Nmap bundled version of Libpcap.

o Applied patch to fix a libpcap alignment bug found by Tom Duffy
  (tduffy(a)sun.com).

o Fixed Windows compilation.

o Applied patch by Chad Loder (cloder(a)loder.us) of Rapid7 which
  fixes OpenBSD compilation.  I believe Chad is now the official
  OpenBSD Nmap "port" maintainer.  His patch also adjusted
  random-scan (-iR) to include the recently allocated 82.0.0.0/8
  space.

o Fixed (I hope) a few compilation problems on
  non-IPv6-enabled machines which were noted by Josef 'Jupp'
  Schugt (jupp(a)gmx.de)

o Included some man page translations which were inadvertently
  missed in previous tarballs.

o Applied patch from Matthieu Verbert (mve(a)zurich.ibm.com) which
  places the Nmap man pages under ${prefix}/share/man rather than
  ${prefix}/man when installed via RPM.  Maybe the tarball
  install should do this too?  Opinions?

o Applied patch from R Anderson (listbox(a)pole-position.org) which
  improves the way ICMP port unreachables from intermediate hosts
  are handled during UDP scans.

o Added note to man page related to Nmap US export control.  I
  believe Nmap falls under ECCN 5D992, which has no special
  restrictions beyond the standard export denial to a handful of
  rogue nations such as Iraq and North Korea.

o Added a warning that some hosts may be skipped and/or repeated
  when someone tries to --resume a --randomize_hosts scan.  This
  was suggested by Crayden Mantelium (crayden(a)sensewave.com)

o Fixed a minor memory leak noted by Michael Davis
  (mike(a)datanerds.net).

Nmap 3.10ALPHA4

o Applied patch by Max Schubert (nmap(a)webwizarddesign.com) which adds
  an add-port XML tag whenever a new port is found open when Nmap is
  running in verbose mode.  The new tag looks like:
  [addport state="open" portid="22" protocol="tcp"/]
  I also updated docs/nmap.dtd to recognize this new tag.

o Added German translation of Nmap man page by Marc Ruef
  (marc.ruef(a)computec.ch).  It is also available at
  http://www.insecure.org/nmap/data/nmap_manpage-de.html

o Includes a brand new French translation of the man page by Sebastien
  Blanchet.  You could probably guess that it is available at
  http://www.insecure.org/nmap/data/nmap_manpage-fr.html

o Applied some patches from Chad Loder (cloder(a)loder.us) which update
  the random IP allocation pool and improve OpenBSD support.  Some
  were from the OBSD Nmap patchlist.

o Fixed a compile problem on machines without PF_INET6.  Thanks to
  Josef 'Jupp' Schugt (deusxmachina(a)webmail.co.za) for noting this.

Nmap 3.10ALPHA3

o Added --min_parallelism option, which makes scans more aggressive
  and MUCH faster in certain situations -- especially against
  firewalled hosts.  It is basically the opposite of --max_parallelism
  (-M).  Note that reliability can be lost if you push it too far.

o Added --packet_trace option, which tells Nmap to display all of the
  packets it sends and receives in a format similar to tcpdump.  I
  mostly added this for debugging purposes, but people wishing to learn
  how Nmap works or for experts wanting to ensure Nmap is doing
  exactly what they expect.  If you want this feature supported under
  Windows, please send me a patch :).

o Fixed a segmentation fault in Idlescan (-sI).

o Made Idlescan timing more conservative when -P0 is specified to
  improve accuracy.

o Fixed an infinite-loop condition that could occur during certain
  dropped-packet scenarios in an Idle scan.

o Nmap now reports execution times to millisecond precision (rather
  than rounding to the nearest second).

o Fixed an infinite loop caused by invalid port arguments.  Problem
  noted by fejed (fejed(a)uddf.net).

Nmap 3.10ALPHA2

o Fixed compilation and IPv6 support on FreeBSD (tested on
  4.6-STABLE).  Thanks to Niels Heinen (niels.heinen(a)ubizen.com) for
  suggestions.

o Made some portability changes based on suggestions by Josef 'Jupp'
  Schugt (jupp(a)gmx.de)

o Fixed compilation and IPv6 support on Solaris 9 (haven't tested
  earlier versions).

Nmap 3.10ALPHA1

o IPv6 is now supported for TCP scan (-sT), connect()-style ping
  scan (-sP), and list scan (-sL)!  Just specify the -6 option and the
  IPv6 numbers or DNS names.  Netmask notation is not currently
  supported -- I'm not sure how useful it is for IPv6, where even petty
  end users may be allocated trillions of addresses (/80).  If you
  need one of the scan types that hasn't been ported yet, give
  Sebastien Peterson's patch a try at http://nmap6.sourceforge.net/ .
  If there is demand, I may integrate more of that into Nmap.

o Major code restructuring, which included conversion to C++ -- so
  you'll need g++ or another C++ compiler.  I accidentally let a C++
  requirement slip in a while back and found that almost everyone has
  such a compiler.  Windows (VC++) users: see the README-WIN32 for new
  compilation instructions.

o Applied patch from Axel Nennker (Axel.Nennker(a)t-systems.com) which
  adds a --without-nmapfe option to the configure script.  This is
  useful if your system doesn't have the proper libraries (e.g. GTK) or
  if you think GUIs are for sissies :).

o Removed arbitrary max_parallelism (-M) limitations, as suggested by
  William McVey ( wam(a)cisco.com ).

o Added DEC OSF to the platforms that require the BSDFIX() macro due
  to taking IP length and offset fields in host rather than network byte
  order.  Suggested by Dean Bennett (deanb(a)gbtn.net)

o Fixed an debug statement C ambiguity discovered by Kronos
  (kronos(a)kronoz.cjb.net)

Nmap 3.00

o Woohoo! :)

Nmap 2.99RC2

o Fixed an important memory initialization bug which was causing
  crashes on Mac OS X (and possibly other platforms).  The problem was
  located by Pieter ten Pierick (P.tenPierick(a)chello.nl)

o Various minor bugfixes/cleanup

Nmap 2.99RC1

o Implemented the biggest OS fingerprint update since December 1999!
  More than 200 fingerprints were added/modified.  This includes
  OpenBSD 3.1, Solaris 9, Mac OS 10.1.5, OS/400, FreeBSD 4.6, The
  latest MS WinXP changes, new CISCO equiptment, and loads of network
  devices such as VoIP phones, switches, printers, WAPs, etc.

o Updated build system to work on MacOS X.

o I removed "credit" lines from the nmap-os-fingerprints file out of
  concern that evil spammers might harvest the 602 addresses.  Plus
  those took up 28K and the size of nmap-os-fingerprints has already
  caused trouble for some handheld devices.  If anyone actually cares
  about the "fame" of being listed, let me know and I'll put you back
  in.  I still appreciate everyone who submits fingerprints!  I just
  don't want you to be spammed when the fingerprint file goes online.

o Minor usage screen (nmap -h) fix suggested by Martin Kluge 
  ( martin(a)elxsi.info )

o Insured that the initial pound (#) in C preprocessor directives is
  always in column 1 (portability fix).  Problem noted by Shamsher
  Sran (ssran(a)bechtel.com)

Nmap 2.54BETA37

o Made SYN scan the default for privileged (root) users.  This offers
  far better performance for Windows users due to their broken
  connect() call, and is usually even preferred on UNIX because it is
  more stealthy and less likely to crash applications listening on the
  target host.

o Fixed a problem noted by Ping Huang (pshuang(a)alum.mit.edu) relating
  to -PI scans of a machine's own non-localhost interfaces (eg
  scanning your ethernet address).

o Applied patch from Patrice Goetghebeur (pgoetghebeur(a)mac.com) which
  fixes PPP/SLIP support on Mac OS X.

o Applied dozens of nmap-services portnumber mapping updates
  researched and sent by palante(a)subterrain.net

o Updated nmap-rpc to the latest version from Eilon Gishri
  (eilon(a)aristo.tau.ac.il)

o Fixed --resume option to better detect all of the previously scanned
  hosts in an -oN file (bug report from Adam.Scott(a)predictive.com )

o Adjusted random IP generator (for -iR) to account for newly
  allocated ip space from
  http://www.iana.org/assignments/ipv4-address-space as noted by Chad
  Loder (cloder(a)acm.org)

o Updated config.sub and config.guess to the versions in
  automake-1.6.2 .

o Applied patch from Markus A. Nonym (g17m0(a)lycos.com) which checks
  for a recent version of GTK+ in ./configure before even trying to
  build NmapFE (avoids the previous ugly compiler errors).

o Applied patch from benkj(a)gmx.it which fixes misbehavior when Nmap
  would receive EOF (including ^D) in interactive mode.

o Fixed format string bugs (not the security-related kind) found by
  Takehiro YONEKURA (yonekura(a)obliguard.com) and Kuk-hyeon Lee 
  (errai(a)inzen.com)

o Applied patch from Greg Steuck (greg-nmap-dev(a)nest.cx) which fixes
  an alignment problem in charpool.c that could cause bus errors on
  64-bit platforms.

o Applied portability fix patch from Matt Christian (mattc(a)visi.com)

Nmap 2.54BETA36

o Fixed major connect scan problem introduced in BETA35

o Changed NmapFE to use the version number 2.54BETA36 rather than
  0.2.54BETA36.  I had to do this because RedHat took the liberty of
  releasing a so-called "2.54BETA31" version of nmap-frontend in their
  7.3 distribution.  Thus my upgrades were failing to install on such
  systems because a "later" version is already installed.

Nmap 2.54BETA35

o Fixed an issue that could cause the abort message "Serious time
  computation problem in adjust_timeout ...".  If you still see this,
  please let me know.

o Fixed Windows compilation (and I really mean it this time -- tested
  myself).

o Applied configure script patch to recognize Solaris 2.10 when it
  eventually becomes available (from James Carlson
  (james.d.carlson(a)east.sun.com)

o Applied some portability fixes from Albert Chin
  (china(a)thewrittenword.com)

o Applied libpcap aclocal.m4 patch to enable debugging (-g) when
  compiling libpcap with gcc.  Patch from Ping Huang
  (pshuang(a)alum.mit.edu)

o Restructured "TCP probe port" output message a bit as suggested by
  Ping Huang (pshuang(a)alum.mit.edu)

Nmap 2.54BETA34

o Windows compilation fixed thanks to new VC++ project file (nmap.dsp) sent
  by Evan Sparks (gmplague(a)sdf.lonestar.org) (I had forgotten to include 
  the new main.c).

o Various nmap-services updates

o Fixed a bunch of typos and capitalization issues in
  nmap-os-fingerprints by applying patch sent in by Royce Williams
  (royce(a)alaska.net).

Nmap 2.54BETA33

o Tons of OS fingerprint updates.  More than 100 fingerprints added or
  changed, including OpenBSD 3, FreeBSD 4.5, Solaris 9 pre-release,
  Commodor 64 (with the TFE Ethernet Card and uIP stack), Compaq iPAQ,
  Cisco IOS 12.2(8), AIX 5.1, IRIX 6.5.15, various
  Redback/Racal/Juniper/BigIP/HP/Siemens/Brocade/Quantum devices,
  numerous printers/switches, KRONOS network clock, WTI Network Power
  Switch, Windows XP, and many more.  Thanks to everyone who
  contributed!

o Applied fix for an important RPC scanning bug sent in by Pasi Eronen
  (pasi.eronen(a)nixu.com)

o Applied fix for nasty OS fingerprinting bug found by William
  Robertson (wkr(a)cs.ucsb.edu)

o Do not show uptime when obviously spoofed (eg OpenBSD 3.0)

o Slightly changed (I hope improved) the whitespace in Nmap output so
  that messages relating to the same host are kept together (and
  different hosts different separated by newlines).

o Moved main() function into a new file, cleverly named main.c.

Nmap 2.54BETA32

o Applied Windows pinging fix and from Andy Lutomirski
  (Luto(a)myrealbox.com)

o Applied a few more Windows fixes from Andy.

o Fixed a flaw in several error-checking statements noted by Giacomo
  Cariello (jwk(a)bug.it)

o Applied Win32 compilation fixes sent by Kirby Kuehl (kkuehl(a)cisco.com)
  and jens.vogt(a)bluewin.ch

Nmap 2.54BETA31

o Added ICMP Timestamp and Netmask ping types (-PP and -PM).  These
  (especially timestamp) can be useful against some hosts that do not
  respond to normal ping (-PI) packets.

o Documented the --data_length option and made it work with all the
  ICMP ping types (echo request, netmask, and timestamp).

o Added check for strings.h before including it in portlist.c .  This
  fixes a compilation problem on some versions of Windows.  Problem
  first noted by Michael Vorin (mvorin(a)hotmail.com)

o Applied patch from Andy Lutomirski (Luto(a)myrealbox.com) which fixes
  a crash on some Windows platforms when timeouts occur.

o Fixed "grepable output" (-oG) so that it prints IPID sequence class
  rather than printing the TCP ISN sequence index twice.  Problem
  noted by Russell Fulton (r.fulton(a)auckland.ac.nz)

o Added mysterious, undocumented --scanflags option.

o Applied patch from Andy Lutomirski (Luto(a)myrealbox.com) which fixes
  some important Windows bugs.  Apparently this can cause a dramatic
  speedup in some circumstances.  The patch had other misc. changes
  too.

o Fix bug noted by Chris V (iselldrugstokidsonline(a)yahoo.com) in which
  Nmap could segmentation fault with the (bogus) command: './nmap -sO
  -p 1-65535 hostname' (protocol only can go up to 255).  That being
  said, Nmap should never segfault just because of bogus options.

o Fixed problem noted by Maximiliano (emax25(a)arnet.com.ar) where Nmap
  would get stuck in a (nearly) infinite loop when you try to "resume"
  a random host (-iR) scan.

o Included a number of fingerprint updates, but I still have many more
  web submissions to go through.  Also made some nmap-services
  portlist updates.

o Included a bunch of fixes (mostly to prevent compiler warnings) from
  William McVey (wam(a)cisco.com)

Nmap 2.54BETA30

o Added a Document Type Definition (DTD) for the Nmap XML output
  format (-oX) to the docs directory.  This allows validating parsers
  to check nmap XML output files for correctness.  It is also useful
  for application programmers to understand the XML output structure.
  The DTD was written by William McVey (wam(a)cisco.com) of Cisco Secure 
  Consulting Services ( http://www.cisco.com/go/securityconsulting ).

o Merged in a number of Windows fixes/updates from Andy Lutomirski
  (Luto(a)myrealbox.com)

o Merged in fixes/updates (mostly to the Windows functionality) from
  Matt Hargett (matt(a)use.net)

o Applied patch by Colin Phipps (cph(a)netcraft.com) which correctly
  encodes special characters in the XML output.

o Applied patch by William McVey (wam(a)cisco.com) which adds the uptime
  information printed with -O to the XML output format.

o Fixed byte-order bug in Windows packet matching code which caused
  -PS and -PT to fail.  Bug found and patch sent by Tim Adam
  (tma(a)osa.com.au)

o Fixed segfault problem with "-sU -F".  Nobody reported this until I
  noticed it :(.  Anytime you see "Segmentation Fault" in the latest
  version of Nmap, it is probably a bug -- please mail me the command
  you used, the OS/platform you are running on, and whether it is
  reproducable.

o Added a convenience option "-oA (basefilename)".  This tells Nmap to
  log in ALL the major formats (normal, grepable, and XML).  You give
  a base for the filename, and the output files will be base.nmap,
  base.gnmap, and base.xml.

o Documented the --append_output option which tells Nmap to append
  scan results to any output files you have specified rather than
  overwriting the files.

o Integrate TIMEVAL_SEC_SUBTRACT() fix by Scott Renfro (scott(a)renfro.org)
  which improves timing accuracy.

Nmap 2.54BETA29

o Integrated William McVey's multi-portlist patch.  This allows you to
  specify different port numbers when scanning both TCP & UDP.  For
  example, if you want to UDP for 53,111 and 137 while TCP scanning
  for 21-25,80,139,515,6000,8080 you could do: nmap -sSU -p
  U:53,111,137,T:21-25,80,139,515,6000,8080 target.com .  Prior to
  this patch, you had to either use different Nmap executions or scan
  both UDP & TCP of each port.  See the man page for more usage info.

o Added/updated a bunch of fingerprints, including Windows XP release
  candidates #1 & #2, OpenBSD 2.9, various home gateways/cable modem,
  MacOS X 10.0.4, Linux 2.4.7, Guantlet Firewall 4.0a, a few Cisco
  routers, and, most importantly, the Alcatel Advanced Reflexes IP
  Phone :).  Many other fingerprints were updated as well.

o Found and fixed some relatively major memory leaks based on reports
  sent in by H D Moore (hdm(a)secureaustin.com), mugz
  (mugz(a)x-mafia.org), and Steven Van Acker (deepstar(a)ulyssis.org)

o Applied patch from Chad Loder (chad_loder(a)rapid7.com) which improves
  random target host selection (-iR) by excluding more undesirable
  addresses.

o Fixed portscan timing bug found by H D Moore (hdm(a)secureaustin.com).
  This bug can occur when you specify a --max_rtt_timeout but not
  --initial_rtt_timeout and then scan certain firewalled hosts.

o Fixed port number printing bug found by "Stephen Leavitt"
  (stephen_j_leavitt(a)hotmail.com)

o The Nmap source tarball now extracts with more lenient permissions
  (sometimes world-readable or world-executable, but never
  world-writable).  If you don't want this, set your umask to 077
  (which is what I do).  Suggested by Line Printer (lps(a)rahul.net)

Nmap 2.54BETA28

o I hope that I have fixed the Libpcap "Unknown datalink type" problem that
  many people reported.  If you still receive this error, please send
  me the following info:
  1) Full output of Nmap including the command you typed
  2) What OS/OS version you are using
  3) What type of interface is the scan going through (PPP, ISDN, ethernet,
     PPPoE, etc)
  4) Whether you compiled from source or used the RPM version

o Hopefully fixed Libpcap lex/yacc generated file problem that
  plagued a few folks.

o Various minor fixes/changes/updates

Nmap 2.54BETA27

o Fixed bug that caused "adding open port" messages to be printed even
  when verbose mode was not specified. (patch sent by Doug Hoyte (
  dugely(a)yahoo.com ).

o Fixed bug in zombie:port option parsing in Idlescan as well a few
  other bugs in patch sent by Germano Caronni (gec(a)acm.org)

o Fixed Windows compilation (I broke it when I added Idlescan).

o Fixed a (Win32 only) port identification bug which would cause some
  ports to be listed as "unknown" even when Nmap should know their
  name.  This was found at patched by David Griffiths
  (davidg(a)intrinsica.co.uk).

o Fixed more nmap-os-fingerprints syntax/grammar violations found by
  Raymond Mercier of VIGILANTe

o Fixed a memory leak in Nbase str*casecmp() functions by applying
  patch sent by Matt (matt(a)use.net).  I plan to kill this whole
  strcasecmp.c file as soon as possible (it is a mess).

Nmap 2.54BETA26

o Added Idlescan (IPID blind scan).  The usage syntax is 
  "-sI [zombie]".

o Fixed a bunch of fingerprints that were corrupt due to violations of
  the fingerprint syntax/grammar (problems were found by Raymond
  Mercier of VIGILANTe )

o Fixed command-line option parsing bug found 
  by "m r rao" (mrrao(a)del3.vsnl.net.in )

o Fixed an OS fingerprinting bug that caused many extra packets to be
  sent if you request a lot of decoys.

o Added some debug code to help diagnose the "Unknown datalink type"
  error.  If Nmap is giving you this error, please send the following
  info to fyodor@insecure.org : 1) The full output from Nmap
  (including the command arguments) 2) What OS and OS version are you
  using 3) What type of adaptor are you using (modem, ethernet, FDDI,
  etc)

o Added a bunch of IDS sensor/console/agent port numbers from
  Patrick Mueller (pmueller(a)neohapsis.com)

Nmap 2.54BETA25

o Added a whole bunch of new OS fingerprints (and adjustments) ranging
  from big important ones (Linux 2.4.X, OpenBSD 2.9, FreeBSD 4.3,
  Cisco 12.2.1, MacOS X, etc) to some that are more obscure ( such as
  Apple Color LaserWriter 12/660 PS and VirtualAccess LinxpeedPro 120 )

o Upgraded Libpcap to the latest version (0.6.2) from tcpdump.org.  I
  modified the build system slightly by shipping pre-generated
  scanner.c/grammer.c (instead of using lex/yacc) and I also upgraded
  to the newest config.sub/config.guess .

o Fixed some issues with the new Libpcap under Linux (patches will be
  sent to the developers).

o Added "All zeros" IP.ID sequence classification to account for the
  new Linux 2.4 scheme which seems to use 0 whenever the DF bit is set
  (probably a good idea).

o Tweaked TCP Timestamp and IP.ID sequence classification algorithms

Nmap 2.54BETA24

o Fixed compilation problems on MacOS X publis release.  Thanks to
  Nicolas Dawson (nizcolas(a)myrealbox.com) for securing an account for
  me.

o On the suggestion of the ever-helpful LaMont Jones (lamont(a)hp.com),
  I obtained the newest config.guess/config.sub from
  http://subversions.gnu.org/cgi-bin/cvsweb/config and made
  libpcap/nbase use symlinks rather than copeis of the file

o Applied patch from LaMont Jones (lamont(a)hp.com) which makes Nmap
  compatible with gcc 3.0 (apparently printf() is a macro in that
  version)

o Applied patch from Colin Phipps (cph(a)netcraft.com) which fixes a
  problem that kept UDP RPC scanning from working unless you were also
  doing a TCP scan.

o Applied a patch from Chris Eagle (cseagle(a)redshift.com) which fixes
  Windows compilation (I broke it with a recent change).

o Updated Lithuanian translation of man page based on a newer version sent 
  by Aurimas Mikalauskas (inner(a)crazy.lt)

o Killed carriage returns in nmap.c and nmapfe.c, which caused
  problems for some (SGI) compilers.  Problem noted by Artur
  Niederstebruch (artur(a)sgi.com)

o Updated to latest version of rpc program number list, maintained by
  Eilon Gishri (eilon(a)aristo.tau.ac.il)

o Fixed a quoting bug in the Nmap man page found by 
  Rasmus Andersson (rasmus(a)pole-position.org)

o Applied RPM spec file changes from "Benjamin Reed"
  (ranger(a)befunk.com) which allows you to avoid building the frontend
  by adding "--define frontend 0" to the build command (eg --rebuild,
  --ba, etc).

Nmap 2.54BETA22

o Eliminated usage of u_int32_t (was causing compilation errors on
  some Sun and HP boxes).  Problem first noted by Nick Munger
  (nmunger(a)Oswego.EDU) and Ralf Hildebrandt
  (Ralf.Hildebrandt(a)innominate.com) and Antonin Sprinzl
  (Antonin.Sprinzl(a)tuwien.ac.at)

o Defined integer-width typedefs such as u32/s32/u16/etc. in Nbase.
  Went through much of the Nmap code and substituted these in where
  correct lengths are important (port numbers, IP addresses, etc).

Nmap 2.54BETA21

o Cleaned up a few build/distribution issues that were reported by
  LaMont Jones (lamont(a)hp.com)

o Fixed compiler warning noted by Gabor Z. Papp (gzp(a)papp.hu) )

Nmap 2.54BETA20 

o Added TCP Timestamp sequence checking for OS detection and
  Netcraft-style uptime tests.

o Found and fixed (I hope) byte alignment problem which was causing
  bus errors on SPARC64 ( reported by H D Moore
  (hdm(a)secureaustin.com) and Matthew Franz (mfranz(a)cisco.com) )

o Apple Darwin (Mac OS X) 1.2 portability patch from Rob Braun
  (bbraun(a)synack.net)

o Added IPID sequence number predictability report (also now used in
  OS detection).

o Show actual IPID, TCP ISN, and TCP timestamp values in XML format
  output rather than just the cooked results.

o Suppress IPID and TCP ISN predictability report unless you use -v
  (you need -O as well).

o Applied Solaris 8 compilation fixes from Germano Caronni (
  gec(a)acm.org )

o Applied configure.in variable name typo fixes from Christian
  Weisgerber (naddy(a)openbsd.org)

o Applied some more changes from Andy Lutomirski
  (Luto(a)mailandnews.com) which provides better detection and
  reporting from some heinous errors.

o Added -n and -R (always/never DNS resolve) options to the man page.

Nmap 2.54BETA19

o I ported NmapFE to Windows so that Win32 users can use the graphical
  interface.  It generally works, although I haven't tested much.
  Patches welcome!

o Various little fixes and cleanups, especially to the Windows port.

o Applied patch from Andy Lutomirski (Luto(a)mailandnews.com) which
  enhances some of the Win* error messages and adds the --win_trace
  debugging option.

o Applied some patches from Jay Freeman (saurik(a)saurik.com)
  o New --data_length option adds indicated number of random data
    bytes to send with scan packet and tcp ping packet (does not
    currently work with ICMP ping packet).  Does not affect OS
    detection, RPC, or connect() scan packets.
    o Windows portability fixes
    o Various other little fixes.

o Renamed rpc.h and error.h because they conflict with Windows include
  files.  By the way, this was a pain to figure out because VC++ is
  such a crappy compiler!  It basically just says problem in
  "foobar.h" without giving you any idea how foobar.h got included!
  gcc gives you a nice message tracing the chain of include files!

Nmap 2.54BETA16

o Upgraded to latest version of Winpcap ( 2.1-beta )

o Merged in Windows port code from Ryan Permeh ( ryan(a)eeye.com) and
  Andy Lutomirski ( Luto(a)mailandnews.com ).

o Took out C++ compiler test from nbase configure script.  It was
  inserted accidently, but I found it interesting that only 2 people
  complained about this causing them problems.  I guess most everyone
  already has C++ compilers.

o Applied patch from Steve Bleazard (steve(a)bleazard.com) which fixed
  bug in internal Smoothed Round Trim Time calculations.

o Fixed CFLAGS computation error in configure.  Problem discovered and
  patched by Fredrik Lundholm (exce7(a)ce.chalmers.se)

o Added more debugging code for "Unknown datalink type" error -- if
  you get this, please send me the full error msg including hex
  values.

o Added Portuguese man page translations from Antonio Pires de Castro
  Junior (apcastro(a)ic.unicamp.br).

o Capitalized all references to God in error messages.

Nmap 2.54BETA7

o Applied patch from Hubert Feyrer
  (hubert.feyrer(a)informatik.fh-regensburg.de) which adds support for
  the new NetBSD DLT_PPP_* types.

o Updated to Eilon Gishri's (eilon(a)aristo.tau.ac.il) newest version
  of nmap-rpc at ftp://ftp.tau.ac.il/pub/users/eilon/rpc/rpc

o Moved a bunch of the scanning engine related functions to new files
  (scan_engine.c and scan_engine.h ).  Timing functions were moved to
  the new timing.c/timing.h .  Other stuff was shifted to
  tcpip.c/tcpip.h.  At some point, nmap.c will only contain the Nmap
  command line UI.

o Updated Russian version of man page from Alex Volkov (topcat(a)nm.ru)

Nmap 2.54BETA6

o Added XML output (-oX).  Hopefully this will help those of you
  writing Nmap front ends and other tools that utilize Nmap.  The
  "machine-readable" output has been renamed "grepable" (-oG) to
  emphasize that XML is now the preferred machine-readable output
  format.  But don't worry if your tool uses -oM , that format (and
  the deprecated -oM flag) won't go away any time soon (if ever).
  Thanks to Stou Sandalski (tangui(a)cell2000.net) and Fredrick Paul
  Eisele (phreed(a)gmail.com) for sending proposals that inspired the
  format used.

o Applied patch from Stefan Rapp (s.rapp(a)hrz.uni-dortmund.de) which
  fixes a variable argument integer promotion problem in the new
  snprintf compatibility file.  This is important for Redhat 7
  systems.

o Reorganized output-related routines so that they now reside in
  output.c & output.h.  Let me know if I accidently screwed up the
  behavior of any scan types in the process.

Nmap 2.54BETA5

o Revamped the 'compatibility libraries' subsystem.  Moved all of that
  to a new library called 'libnbase' and changed Nmap and NmapFE to
  use that.  I included a better version of *snprintf and some other
  compatibility files.  Obviously I cannot test these changes on every
  whacked OS that needs this compatibility cruft, so please let me
  know if you run into compilation problems.

o Fixed a problem found by Martyn Tovey (martyn(a)netcraft.com) when
  using Nmap on platforms that dislike division by zero.

o Removed 128.210.*.* addresses from Nmap man page due to complaints
  from Purdue security staff.

o Fixed FreeBSD (some versions) compilation problem found by Martyn
  Tovey (martyn(a)netcraft.com)

Nmap 2.54BETA4

o Upgraded to the very latest Libpcap version ( the 9/3/00 CVS
  snapshot ).  This version is from the tcpdump.org group rather than
  the Lawrence Livermore crew.  The most important advantage is Linux
  Socket Filter support (so you won't have that annoying syslog
  message about Nmap using the obsolete SOCK_PACKET interface).

o I tried to install Nmap on yet another machine without lex/yacc or
  flex/bison.  That was the last straw!  I am now shipping the
  generated C files, which eliminates the lex/yacc requirement.

o Applied patch by Jay Freeman (saurik) (saurik(a)saurik.com) to make
  Nmap C++-clean (this was lot of tedious work!  Thanks!).  Note that
  Nmap still uses a normal C compiler by default, but Nmap derivatives
  may appreciate C++ compatibility.  Note that this only applies to
  "Nmap proper", not libpcap.

o Added a HACKING file for people who want to help with Nmap
  development.  It describes preferred patch formats, development
  resources, and offers a number of useful changes that would likely
  be accepted into the main tree.

o Fixed a configure.in error found by Vacuum
  (vacuum(a)technotronic.com) which could cause compilation errors.

o Fingerprint file adjustments for better Win* detection

o Ensure libpcap is not configured and/or installed if you already
  have a "new enough" version (0.4a6+) installed.

o Included Italian translation of Nmap man page from Giorgio Zoppi
  (deneb(a)supereva.it) .

o Fixed a SYN scan problem that could cause a major slowdown on some
  busy networks.

o Fixed a crash problem in NmapFE reported by sverre ( sverre(a)gmx.net )

o Added an "SInfo" line to most printed fingerprints.  It looks
  similar to this:
  SInfo(V=2.54BETA4%P=i686-pc-linux-gnu%D=9/4%Time=9681031%O=7%C=1)
  and contains information useful when fingerprints are reported (Nmap
  version/platform, scan date, and open/closed ports used)

o Fixed RPCGrind (-sR) scan.  It has been almost completely broken
  since 2.54BETA2 (which has been out for two weeks) and nobody
  reported it!  I noticed the problem myself during testing of
  something else.  I am disappointed that nobody bothered to even let
  me know that this was broken.  Does anyone even use RPC Scan?

o Various other small fixes/improvements

Nmap 2.54BETA3

o Went through and added/adjusted a bunch of fingerprints.  A lot of
  people submitted Windows Millenium Edition (WinME) beta
  fingerprints, but nobody submitted IPs for them.  So please let me
  know if this version detects your WinME boxes.

o Applied NmapFE patch from Michael Fischer v. Mollard (mfvm(a)gmx.de)
  which made did the following:
  o Added delete event so that NmapFE always quits when you kill it
    with your window manager
  o added the menubar to the vbox instead to the fixed widget

o Various small fixes/improvements

Nmap 2.54BETA2

o Added a shortcut which can make single port SYN scans of a network
  much faster.  For example, if a new sendmail vulnerability is found,
  this reduces the time it takes to scan your whole network for port
  25.  This shortcut takes effect when you do "-PS[port] -sS
  -p[port]".  For example 'nmap -n -sS -p25 -PS25 24.0.0.0/8".  This
  optimization doubled the scan speed in a 30,000 IP test I performed.

o Added -sL (List scan).  Just as ping scan (-sP) allows you to short
  circuit the scan right after pinging, -sL allows you to short
  circuit the scan right after target selection.  This allows you to
  see what hosts WOULD be scanned without actually doing it.  The
  hosts will be resolved unles you use -n.  Primary uses:
  1) Get all the IPs in a network (like A.B.C.D/16) and take out
     machines that are too fragile to be scanned safely before
     calling Nmap with the new list (using -iL).
  2) Test that a complex spec like 128.4,5,7-9.*.7 does what you
     expect before actual scanning.
  3) When all you want to do is resolve a bunch of IPs.
  4) You just want results of a zone transfer (if it is implemented).

o Added some new fingerprints and adjusted some others based on
  submissions to the DB (I still have a lot more to go through so
  don't worry if your submission is still not detected).

o Added a warning when you scan 0 hosts (eg "nmap -v").  There are
  various other output tweaks as well.

o Ensured that 0.0.0.0 can be scanned by nmap (although on some OSs,
  like Linux, it won't work due to what seem to be kernel bugs).  Oh
  well.  I'll look into it later.

Nmap 2.54BETA1

o Added an extremely cool scan type by Gerhard Rieger ( rieger at
  iue.tuwien.ac.at ) -- IP Protocol scanning.  Basically it sends a
  bunch of IP headers (no data) with different "protocol" fields to
  the host.  The host then (usually) sends back a protocol unreachable
  for those that it does not support.  By exclusion, nmap can make a
  list of those that are supported.  This is similar in concept to
  (and is implemented using most of the same scanning routines as) UDP
  scanning.  Note that some hosts do not send back protocol
  unreachables -- in that case all protocols will appear "open".

o Fixed an uninitialized variable problem in NmapFE (found by Alvin
  Starr (alvin at iplink.net )

o Fixed a packaging problem that lead to the Nmap man page being
  included twice in the .tgz .

o Fixed dangling nroff include in xnmap man page (noted by Debian Nmap
  package maintainer LaMont Jones (lamont(a)security.hp.com)

o Give a warning when no targets at all are specified

o Updated 'make uninstall' so that it deletes all relevant files

o Included latest nmap-rpc from Eilon Gishri (eilon at aristo.tau.ac.il)

o Eliminated -I. from Nmap's and NmapFE's makefiles (suggested by "Jay
  Freeman (saurik)" (saurik at saurik.com)

o Added Russian documentation by Alex Volkov

o Added Lithuanian documentation from Aurimas Mikalauskas (inner(a)dammit.lt) 

Nmap 2.53

o Fixed a commenting issue that could cause trouble for non-GNU
  compilers (first found by Jan-Frode Myklebust (janfrode at
  parallab.uib.no))

o A few new services to nmap-services

Nmap 2.52

o Added very simple man pages for xnmap/nmapfe (lack of man pages for
  these was noticed by LaMont Jones (lamont(a)hp.com), the Debian Nmap
  package maintainer, based on bug report by Adrian Bunk
  (bunk(a)fs.tum.de ).

o Fixed a "Status: Down" machine name output problem in machine
  parseable logs found by Alek O. Komarnitsky (alek(a)ast.lmco.com)

o Took some wierd files out of the doc directory (cd, grep , vi, and
  .swp)

o Fixed some typos found by Thomas Klausner (wiz(a)danbala.ifoer.tuwien.ac.at)

o Updated nmap-rpc with new entries found in the latest version of
  Eilon Gishri's rpc list.

Nmap 2.51

o Fixed target parsing bug found by Steve Horsburgh (shorsburgh(a)horsburgh.com).

o Changed makefile/rpm to store fingerprint, rpc, and services file in
  $prefix/share/nmap rather than $prefix/lib/nmap , since these files
  are architecture independent.  You should now use ./configure
  --datadir instead of ./configure --libdir to change the default
  location.  Suggested by Thomas Klausner
  (wiz(a)danbala.ifoer.tuwien.ac.at).

o I am now including Eilon Gishri's (eilon(a)aristo.tau.ac.il) rpc
  number list (which he recently merged with the Nmap 2.50 rpc list).

o Included Spanish and French HTML versions of the Nmap man page (may
  not always be up to date).

Nmap 2.50

o Fixed an IP calculation error which could occur in some cases where
  you scan machines on different devices (like lo and eth0).  This
  problem was discoved by Jonathan Fine (jfine(a)psu.edu).

o Fixed a problem that could, in rare cases, cause a SYN scan scan to
  crash (the error message was "attempt to add port number X with
  illegal state 0").  This problem was reported by Erik Benner
  (erik(a)xyzzy.net)

o Changed the .spec file so that RPM versions create a xnmap link to
  nmapfe ( the normal make install has done this for a long time ).

Nmap 2.3BETA21

o A number of people reported problems with nmapfe in various
  environments (specifically gdk errors, hangs, and crashes).  I think
  that is now fixed.  Let me know if you still have the problem (make
  sure the title bar says BETA21).

o Added a bunch of OS fingerprints based on all the contributions in
  the last month or so.

o Fixed a bug that completely broke RPC scanning in BETA19.

o Added list of ports scanned near the top of each machine log WHEN
  -v was specified.  Here is an example of the format:
  # Ports scanned: TCP(13;1-10,22,25) UDP(0;)
  The "13" above is the number of TCP ports being scanned.

o Got rid of a snprintf() from nmapfe sine some systems don't have it
  :( and I'm to lazy to integrate in the snprintf that comes with nmap
  right now.

o Fixed important target IP range parsing bug found by Jean-Yves Simon
  ( lethalwp(a)linuxbe.org ).

o Applied patch by albert chin (china at thewrittenword.com) which
  adds --with-libpcap[=DIR] option to configure and and adds an
  elegant approach for -lnsl and -lsocket checking to configure .

o Fixed a bug which could cause Nmap to mark a port filtered based on
  ICMP dest. unreachable packets relating to a different host than the
  one being scanned.

o Fixed output problem relating to ident scan noted by Peter Marschall
  ( peter.marschall at mayn.de )

o Applied patch to services.c by Andrew Brown (atatat(a)atatdot.net)
  which prevents some useless debugging (-d) output when reading some
  kindss of /etc/services files.

o Added "Host: [machinename] (ip) Status: Down" to machine logs when
  the verbose option is given (just like down hosts are reported to
  stdout when verbose is given).  Suggested by Alek Komarnitsky.

o Applied NetBSD compatibility patch provided by Mipam (reinoud at
  ibbnet.org) which changes an autoconf macro to check for
  getopt_long_only instead of getopt_long.

o Nmap used to print an inaccuracy warning when no open TCP ports were
  found on the target machine.  Due to a bug, this was not always
  being printed.  Problem found by Matt (matt at use.net) and Ajay
  Gupta2 (Ajay.Gupta2 at ey.com).

o Added the number of ports in the ignored state right after the state
  name in machine parseable logs.  It used to looke like: "Ignored
  State: closed" whereas now it looks like: "Ignored State: closed
  (1508)" Meaning that 1508 ports were closed and thus are not
  specifically enumerated.

o Changed all nmapfe calls to gdk_font_load into gdk_fontset_load .
  Bennett Feitell (bfeitell at panix.com) suggested that this fixed
  some nmapfe font problems.

Nmap 2.3BETA20

o Applied patch sent in by s.rapp(a)hrz.uni-dortmund.de which fixes a
  memory alignment bug in osscan.c which could cause core dumps on
  machines which require aligned access (like SPARC).

o Fixed a compilation problem on machines that do not have MAP_FAILED
  defined (as a return value to mmap).  Problem noted by Phil
  Stracchino (alaric(a)babcom.com).

Nmap 2.3BETA19

o Tweaked the output so that it now tells how many ports are not shown
  and what state the ignored ports are in.  This info could be
  inferred before by people who had studied the manpage, but now the
  info is explicitly available.  I cleaned up a bunch of stuff
  internally to make this happen.  I hope I didn't break anything!

o Changed NmapFE so that it always kills any running Nmap process when
  you press exit. Problem noted by Marc Renner
  (mrenner(a)ci.marysville.wa.us)

o Apparently some Linux (glibc) systems now come with a "strcasestr"
  function.  So I have made autoconf look for this and use the native
  version if supported. (problem noted by Sami Farin
  (sfarin(a)ratol.fi)).

o Added a new attribute "Ignored State: xxx" to the machine parseable
  logs, where xxx is the state (closed, filtered, or UNfiltered) that
  is being ignored.  Ports in that state are not listed (they weren't
  listed in earlier versions either).  Perhaps I should list ALL ports
  for machine parseable output.  Opinions?

o Merged in a patch sent in by Mipam (reinoud(a)ibbnet.org) which is
  apparently part of the OpenBSD Nmap "port".  Although Nmap seems to
  work fine for me on my OpenBSD 2.4 box, a couple OpenBSD users have
  complained of problems.  Hopefully this will help. (it adds DLT_LOOP
  and DLT_ENC offset cases when reading from libpcap).

o A few really minor bugfixes.

Nmap 2.3BETA18

o Fixed a very important bug that occurred when SYN scanning
  localhost.  Many thanks to Dries Schellekens (
  gwyllion(a)ace.ulyssis.student.kuleuven.ac.be ) for first reporting
  the problem.

o Uros Prestor from TurboLinux informed us that the latest versions of
  Nmap work with Linux on the upcoming Intel Merced/Itanium IA-64
  processors.  He also said that the TurboLinux distribution includes
  Nmap.  Kudos to them!  As well as the other distros that support
  Nmap (Debian, Red Hat, Suse, Trinux) and of course FreeBSD, NetBSD,
  & OpenBSD.  Does anyone know if Nmap ships with the latest from
  Mandrake or Corel?  The latest Solaris includes some Free software.
  If anyone can get them to ship Nmap, I will buy you a case of beer
  :).

o Added a #define to change vsnprintf to vsprintf on machines which do
  not support the former (mostly Solaris 2.5.1 and earlier).  This
  function is less safe.  For people who care about security, we
  recommend an upgrade to Solaris 8 (or Linux/*BSD).

o Changed the NmapFE version to 0.[nmap_version] rather than always
  leaving it at 0.9.5 (which was confusing).  Thanks to J.D.K. Chipps
  (jdkc(a)woptura.com) for noticing this.

o Added support for "-vv" (means the same as "-v -v").  Older versions
  of Nmap supported it (noted by George Kurtz).

Nmap 2.3BETA17

o Added ACK scanning.  This scan technique (which van Houser and
  others have been bugging me to add for years :), is great for
  testing firewall rulesets.  It can NOT find open ports, but it can
  distinguish between filtered/unfilterd by sending an ACK packet to
  each port and waiting for a RST to come back.  Filtered ports will
  not send back a RST (or will send ICMP unreachables).  This scan
  type is activated with -sA .

o Documented the Window scan (-sW) which Lamont Granquist added in
  September 99.

o Added a whole bunch of OS fingerprints that people have submitted.

o "Protocol" field in output eliminated.  It is now printed right next
  to the number (/etc/services style).  Like "22/tcp".  I wonder what
  I should put in the extra white space this leaves on the report :).

o Added --resume option to continue a large network scan where you
  left off.  This is useful for recovering from errors (modem drops
  carrier, network outage, etc).  It also allows you to start and stop
  for policy reasons (like if a client only wants you to scan on
  weekends or at night) or if you want to run the scan on a different
  host.  Usage is 'nmap --resume logfile' where logfile can be either
  normal (-oN) or machine parseable (-oM) logfile from the scan that
  was aborted.  No other options can be given (the options in the
  logfile from the original scan will be used).  Nmap will start off
  with the host after the last one successfully scanned in the log
  file.

o Added --append_output option which causes -oN/-oM/-oS to APPEND to
  the output file you specify rather than overwriting it.

o Various internal code cleanup, makefile fixes, etc.

o Changed version number from 2.3BETA* to 2.30BETA* to appease various
  packaging systems that thought 2.3BETA was < 2.12 .

o Nmap output to files now correctly flushes output after scanning for
  each host is finished.

o Fixed compiler -L flags error found by Ralf Hildebrandt
  (R.Hildebrandt(a)tu-bs.de)

o Fixed configure scripts so that options you give to the Nmap
  configure (like --prefix ) are also passed to the nmapfe configure
  script.  This problem was noted by Ralf Hildebrandt
  (R.Hildebrandt(a)tu-bs.de).  While I was at it, I added some other
  cleanups to the system.

o Added --noninteractive option for when nmap is called from scripts
  (where stuff like prompting users for info is unacceptable).  It
  does not currently do anything (Nmap never prompts) and script
  writers should probably wait until at least May '2000 so their
  scripts still work with earlier versions of Nmap.

o Updated to the latest config.guess and config.sub from Autoconf 2.13

o Applied patch by Sven (s.carstens(a)gmx.de> which fixes a
  segmentation fault problem in Nmapfe colored mode as well as some
  output niceties.

o Changed some C++ comments to C-style for portability (noticed by
  "Sergei V. Rousakov" (sergei(a)cas.Vanderbilt.Edu) )

Nmap 2.3BETA14

o Peter Kosinar (goober(a)gjh.sk) performed some cleanup of the output
  routines and as a bonus he added skript kiddie output mode!!!  Try
  it out by adding "-oS - " to your nmap command line.  Note that
  using '-' to represent stdout instead of a filename is something you
  can do with any of the output modes.

o Ensured that Nmap always gives up on ident scan after the first port
  attempt finds it to be closed (problem noticed by Matt
  (matt(a)use.net))

o Changed strsep's in nmapfe to more portable strtok's (should
  especially help Nmapfe compiles on Solaris)

o Changed permutation algorithm to make port order and host order
  shuffling more random.

o Various minor changes and internal code cleanup.

o Fixed integer overflow that was limiting the max --host_timeout
  value to about 2,000,000 milliseconds (~1/2 hour).  The limit is now
  about 4,000,000,000 milliseconds (~1 month).  I really hope you
  don't need more than that :).

Nmap 2.3BETA13

o I made Nmap smarter about detecting filtering during UDP, Xmas,
  NULL, and FIN scans.

o Updated Nmapfe to 0.9.5 (+ a patch from NmapFE author Zach Smith)

o Fixed a problem where NmapFE would fail to honor $PATH (Noticed by
  K. Scott Rowe (kscott(a)nmt.edu)

o Added a couple ICMP unreachable messages Nmap was missing (found by
  Bifrost (bifrost(a)minions.com)).

o Internal cleanup that improves the way some port lists are stored.

o Added some more RPC numbers from (mmmorris(a)netscape.net)

o Relaxed the dependency requirements of nmapfe rpm (now will accept
  any version of Nmap).

Nmap 2.3BETA12

o Added interactive mode which adds convenience for managing nmap
  sessions and also enhances privacy.  Get to it with --interactive
  and then type 'h' for help.

o Added/modified many fingerprints including the latest 2.3.X Linux
  releases, the latest Win2000 builds, the Apple Airport Wireless
  device, and several dozen more.

o Migrated to RPM .spec file sent in by Tim Powers
  (timp(a)redhat.com).  That is the file they will be using to package
  Nmap with the power tools CD in the next Redhat release.  The most
  important changes are that Nmap (only the RPM version) now installs
  in /usr/* instead of /usr/local/* and the frontend is now
  dynamically linked with GTK and comes in a separate rpm.

o The -i (input from list) option has been deprecated.  From now on
  you should use -iL [filename] to read from a list or -iR to have
  Nmap generate random IPs to scan.  This -iR option is new.

o The -o and -m options have been deprecated.  From now on, you should
  use -oN for normal (human readable) output and -oM for machine
  parseable output.  At some point I might add -oH (HTML output) or
  -oSK (sKr|pt kiDdi3 0uTPut).

o Added --randomize_hosts option, which causes hosts be be scanned in
  non-sequential order.  This makes scans less conspicuous.  For
  efficiency reasons, the hosts are chopped into groups of 2048 and
  then each group is internally shuffled (the groups still go in
  order).

o Rearranged the help ('nmap -h' or 'nmap' or 'nmap --help') screen to
  be shorter (37 -> 23 lines!) and include some of the new features of
  this release.  The man page was updated as well.

o Fixed longstanding bug where nmap -sS mylocalnetwork/24 would not
  successfully scan the host running nmap.

o Internal improvements to make scanning faster with -i (input list)
  or when you specify multiple machines on the command line.

o Uses faster GCD algorithm and fixed several typos (sent in by Peter
  Kosinar).

o Provide more information in machine/human readable output files
  (start time, end time, RPC program name, Nmap version number)

o Killed the -A option (if you don't know what that is then you won't
  miss it.  In fact, even if you do know what it is you won't miss
  it.)

Nmap 2.3BETA10

o Added about 70 new OS fingerprints so that Nmap can detect more
  systems.  The most important new fingerprints are probably:
  * The new SP5+ NT boxes -- After all these years MS FINALLY made
    sequence prediction harder (on NT anyway).
  * Solaris 8 Pre-Release
  * Sega Dreamcast (Hack that!)
  * Latest Windows 2000 builds
  * OpenBSD 2.6

Nmap 2.3BETA9

o Applied patch by Mark Abene (Phiber Optik) to fix several type
  length issues so that it works on Linux/Alpha.

o Applied patch by Matthieu Verbert (mve(a)zurich.ibm.com) to speed up OSScan

Nmap 2.3Beta8

o Added "firewall mode" timing optimizations which can decrease the
  ammount of time neccessary to SYN or connect scan some heavily
  filtered hosts.

o Added min_rtt_timeout timing option (see man page for details)

o Changed "TCP Ping" to use a random ACK value rather than 0 (an IDS
  called Snort was using this to detect Nmap TCP Pings).

o Some changes for better Alpha/Linux support based on investigation
  by Bill Beers (wbeers(a)carolina.rr.com)

o Applied changes for FDDI support by Tobias J. Nijweide (tobias(a)mesa.nl)

o Applied a socket binding patch from LaMont Jones
  (lamont(a)security.hp.com) which can be useful when using -S to
  specify one of multiple interfaces on a machine.

o Made OS detection smart enough to first check scan results for a
  known closed port instead of immediately resorting to a random one.
  This improves OS detection against some machines behind packet
  filters. (suggested by van Hauser)

o Applied a shortcut suggestion by Thomas Reinke which can lead to a
  tremendous speedup against some firewalled hosts.

o Added some ports commonly used for RPC to nmap-services

o Fixed a problem with the timing of an RPC scan (could come before
  the UDP scans they rely on)

o Added a number of new ports to nmap-services

Nmap 2.3Beta6

o Added sophisticated timing controls to give the user much more
  control over Nmap's speed.  This allows you to make Nmap much more
  aggressive to scan hosts faster, or you can make Nmap more "polite"
  -- slower but less likely to wreak havoc on your Network.  You can
  even enforce large delays between sending packets to sneak under IDS
  thresholds and prevent detection.  See the new "Timing Options"
  section of the Nmap man page for more information on using this.

o Applied Lamont Granquist's (lamontg(a)u.washington.edu) Window scan
  patch (I changed the name from ACK scan to Window scan since I may
  add another scan that uses ACK packets and I don't want them to be
  confused).  -sW activates this scan type.  It is mostly effective
  against BSD, AIX, Digital UNIX, and various older HP/UX, SunOS, and
  VAX. (See nmap-hackers mailing list archives for an extensive list).

o Added various long options people expect to see like --version ,
  --help , --usage , etc.  Some of the new timing options are also long.
  I had to add getopt_long C files since most non-Linux boxes don't
  support getopt_long in libc.

o Human readable (-o) output changed to include the time/date of the
  scan.  Suggested by van Hauser.

Nmap 2.3-Beta5

o Changed RPC output based on suggestions by David O'Brien
  (obrien(a)NUXI.com) and Lance Spitzner (lance(a)spitzner.net).  I
  got rid of the "(Non-RPC)" unnecessary clutter which appeared after
  each non RPC port and the "(untested)" that appeard after each
  "filtered" port.

o Added a ton of new OS fingerprints people submitted.  I had about
  400 in my inbox.  Of course, almost 100 of them were submissions for
  www.windows2000test.com :).

o Changed the machine parseable output of RPC information to include
  the version information.  If we figured out the RPC info, it is now
  provided as "program-num*lowversion-highversion".  If we didn't get
  the number, but we think the port is RPC, the field simply contains
  "R".  If we believe the port is NOT RPC, then the field contains
  "N".  If the field is empty, we did not RPC scan the port.  Thanks
  to H D Moore (nlog(a)ings.com) for making me aware how much the
  earlier machine parseable RPC logging sucked :).

Nmap 2.3-Beta4

o Added direct (non-portmapper) RPC scanning to determine what RPC
  program is listening on a particular port.  This works for UDP and
  TCP ports and is currently implemented using sockets (which means
  you can't use decoys, but on the other hand you don't have to be
  root).  Thanks go to ga (ga(a)capyork.com) for writing sample code
  to demonstrate the technique.  The RPC services list included with
  nmap was compiled by Vik Bajaj (vbajaj(a)sas.upenn.edu) with help
  from various members of the nmap-hackers list.

o Fixed a problem that could cause freezes when you scan machines on
  at least two different types of interfaces as part of the same
  command.

o Identified and found workaround for Linux kernel bug which allows
  connect() to sometimes succeed inapropriately when scanning closed
  ports on localhost.

o Fixed problems relating to people who specify the same port more
  than once on the command line.  While the right answer is "well,
  don't do that!", I decided to fix nmap to handle this gracefully.

o Tweaked UDP scanning to be more effective against Solaris ICMP error
  limiting.

o Fixed strtol() integer overflow problem found by Renaud Deraison
  (deraison(a)cvs.nessus.org)

o The HTML translation of the Man page at
  http://www.insecure.org/nmap/nmap_manpage.html should now be
  complete (man2html was dropping lines before).

o Added a note in the man page that Nmap 2.0+ is believed to be
  COMPLETELY Y2K COMPLIANT!  I've been getting a lot of letters from
  laywers about that recently.  You should still be able to port scan
  on Jan 1st (well ... as long as you have electricity and gangs of
  looting thugs haven't stolen your computers :)

Nmap 2.2-Beta4

o Integrated nmapfe code from Zach Smith to allow the nmapfe output
  window to resize when you resize the nmapfe window.

o Integrated patch sent in by Stefan Erben (stefan(a)erben.com) which
  allows nmap to recognize and ignore null interfaces.  If you were
  getting a bogus error like "eth0 not found in /proc/net/route" then
  this should solve your problem.

o Applied patch from Alexander Savelyev (fano(a)ham.kiev.ua) which
  gives nmap the parameters necessary to support SLIP and PPP on BSDI
  systems.

o Upgraded to a new version of shtool (1.2.3)

Nmap 2.2-Beta3

o Adopted Ralf S. Engelschall's excellent shtool script for
  simplifying the nmap makefile and making it more portable

o Various other minor changes to nmapfe.

Nmap 2.2-Beta2

o Cleaned up build environment more, fixed up RPM and Makefile.in,
  eliminated the automake stuff.

o Added nmapfe feature to show nmap command as you change options

o Changed nmapfe to use a global MyWidgets struct rather than tons of
  global vars all over the place.

o Made nmapfe much smarter about rejecting stupid option attempts.  It
  now tries to correct things when you specify illegal options.

o GTK+ 1.0 compatibility fixes

o Integrated nmapfe changes from Zach

Nmap 2.2-BETA1

o Integrated in nmapfe -- a cool front end wrottem by Zach Smith (matrxweb(a)hotmail.com)

Nmap 2.12

o Changed the way tcp connect() scan determines the results of a
  connect() call.  Hopefully this will make nmap a little more
  portable.

o Got rid of the security warning message for people who are missing
  /dev/random and /dev/urandom due to complaints about the warning.
  This only silences the warnings -- it still uses relatively weak
  random number generation under Solaris and other systems that lack
  this functionality.

o Eliminated pow() calls on Linux boxes.  I think some sort of glibc
  bug was causing nmap to sigsegv in some cases inside of pow().  Most
  people weren't affected, but those who were would almost always
  SIGSEGV with -O.

o Fixed an rpm problem noted by Mark Smith (marks(a)senet.com.au)

Nmap 2.11

o Many new fingerprints added.  I received more than 300 submissions
  between this release and the last one.

o Fixed IRIX problems which prevented OS scanning from working on that
  platform.  The problem was researched and solution found by Lamont
  Granquist (lamontg(a)u.washington.edu).  You can also thank him for
  porting nmap to almost every UNIX around.

o Added support for '-m -' to redirect machine readable logs to stdout
  for shell pipelining, etc.  I also changed machine readable output
  to show service names now that we use a nmap specific services file
  rather than /etc/services.  These features were suggested by Dan
  Farmer.  You can also thank him for SATAN (the auditing tool).

o Fixed a link-list bug that could cause hangs in UDP,FIN,NULL, and
  XMAS scans.  Also fixed a ptr problem that could cause SIGSEGV.
  These problem were discovered and tracked down by Ben Laurie
  (ben(a)algroup.co.uk).  You can also thank him for Apache, OpenSSL,
  and Apache-SSL.

o Fixed installation problem for people without a /usr/local/man/man1
  directory.  Found by Jeffrey Robertson (a-jeffro(a)microsoft.com).
  I guess you can thank him for Win98 ;).

o Several other little fixes to the installation script and minor
  scanner tweaks.

Nmap 2.10

o Private test release 

Nmap 2.09

o Private test release 

Nmap 2.08

o Bugfix for problem that can cause nmap to appear to "freeze up" for
  long periods of time when run on some busy networks. (found by
  Lamont Granquist)

Nmap 2.07

o Fixed a lockup on Solaris (and perhaps other proprietary UNIX
  systems) caused by a lack of /dev/random & /dev/urandom and a rand()
  that only returns values up to 65535.  Users of Free operating
  systems like Linux, FreeBSD, or OpenBSD probably shouldn't bother
  upgrading.

Nmap 2.06

o Fixed compile problems on machines which lack snprintf() (found by
  Ken Williams (jkwilli2(a)unity.ncsu.edu))

o Added the squid proxy to nmap-services (suggested by Holger Heimann)

o Fixed a problem where the new memory allocation system was handing
  out misaligned pointers.

o Fixed another memory allocation bug which probably doesn't cause any
  real-life problems.

o Made nmap look in more places for nmap-os-fingerprints

Nmap 2.05

o Tons of new fingerprints.  The number has grown by more than 25%.
  In particular, Charles M. Hannum (root(a)ihack.net) fixed several
  problems with NetBSD that made it easy to fingerprint and he sent me
  a huge new batch of fingerprints for various NetBSD releases down to
  1.2.  Other people sent NetBSD fingerprints down to 1.0.  I finally
  got some early Linux fingerprints in (down to 1.09).

o Nmap now comes with its own nmap-services which I created by merging
  the /etc/services from a bunch of OS' and then adding Netbus, Back
  Orifice, etc.

o Random number generation now takes advantage of the /dev/urandom or
  /dev/random that most Free operating systems offer.

o Increased the maximum number of OS guesses nmap will make, told nmap
  never to give you two matches where the OS names are byte-to-byte
  equivalent.  Fixed nmap to differentiate between "no OS matches
  found" and "too many OS matches to list".

o Fixed an information leak in the packet TTL values (found by HD
  Moore (hdmoore(a)usa.net))

o Fixed the problem noted by Savva Uspensky about offsets used for
  various operating systems' PPP/SLIP headers.  Due to lack of
  responses regarding other operating systems, I have made assumptions
  about what works for BSDI, NetBSD, and SOLARIS.  If this version no
  longer works on your modem, please let me know (and tell me whether
  you are using SLIP/PPP and what OS you are running).

o Machine parseable logs are now more machine parseable (I now use a
  tab to seperate test result fields rather than the more ambiguous
  spaces.  This may break a few things which rely on the old format.
  Sorry.  They should be easy to fix.

o Added my nmap-fingerprintinting-article.txt to the distribution in
  the docs directory.

o Fixed problem where nmap -sS (my_ethernet_or_ppp_ip_address) would
  not correctly scan localhost (due to the kernel rerouting the
  traffic through localhost).  Nmap should now detect and work around
  this behavior.

o Applied patch sent to my by Bill Fenner (fenner(a)parc.xerox.com)
  which fixes various SunOS compatibility problems.

o Changed the makefile 'all' target to use install-sh rather than
  mkdir -p (doesn't work on some systems)

o Documentation updated and clarified slightly.

o Added this CHANGELOG file to the distribution.
 07070100243fe1000081a40000000a0000000a0000000144fe8f260000640b000000880000000a00000000000000000000001700000005reloc/doc/nmap/COPYING    
/***************************************************************************
 * COPYING -- Describes the terms under which Nmap is distributed.  A copy *
 * of the GNU GPL is appended to this file.                                *
 *                                                                         *
 ***********************IMPORTANT NMAP LICENSE TERMS************************
 *                                                                         *
 * The Nmap Security Scanner is (C) 1996-2004 Insecure.Com LLC. Nmap       *
 * is also a registered trademark of Insecure.Com LLC.  This program is    *
 * free software; you may redistribute and/or modify it under the          *
 * terms of the GNU General Public License as published by the Free        *
 * Software Foundation; Version 2.  This guarantees your right to use,     *
 * modify, and redistribute this software under certain conditions.  If    *
 * you wish to embed Nmap technology into proprietary software, we may be  *
 * willing to sell alternative licenses (contact sales@insecure.com).      *
 * Many security scanner vendors already license Nmap technology such as  *
 * our remote OS fingerprinting database and code, service/version         *
 * detection system, and port scanning code.                               *
 *                                                                         *
 * Note that the GPL places important restrictions on "derived works", yet *
 * it does not provide a detailed definition of that term.  To avoid       *
 * misunderstandings, we consider an application to constitute a           *
 * "derivative work" for the purpose of this license if it does any of the *
 * following:                                                              *
 * o Integrates source code from Nmap                                      *
 * o Reads or includes Nmap copyrighted data files, such as                *
 *   nmap-os-fingerprints or nmap-service-probes.                          *
 * o Executes Nmap and parses the results (as opposed to typical shell or  *
 *   execution-menu apps, which simply display raw Nmap output and so are  *
 *   not derivative works.)                                                * 
 * o Integrates/includes/aggregates Nmap into a proprietary executable     *
 *   installer, such as those produced by InstallShield.                   *
 * o Links to a library or executes a program that does any of the above   *
 *                                                                         *
 * The term "Nmap" should be taken to also include any portions or derived *
 * works of Nmap.  This list is not exclusive, but is just meant to        *
 * clarify our interpretation of derived works with some common examples.  *
 * These restrictions only apply when you actually redistribute Nmap.  For *
 * example, nothing stops you from writing and selling a proprietary       *
 * front-end to Nmap.  Just distribute it by itself, and point people to   *
 * http://www.insecure.org/nmap/ to download Nmap.                         *
 *                                                                         *
 * We don't consider these to be added restrictions on top of the GPL, but *
 * just a clarification of how we interpret "derived works" as it applies  *
 * to our GPL-licensed Nmap product.  This is similar to the way Linus     *
 * Torvalds has announced his interpretation of how "derived works"        *
 * applies to Linux kernel modules.  Our interpretation refers only to     *
 * Nmap - we don't speak for any other GPL products.                       *
 *                                                                         *
 * If you have any questions about the GPL licensing restrictions on using *
 * Nmap in non-GPL works, we would be happy to help.  As mentioned above,  *
 * we also offer alternative license to integrate Nmap into proprietary    *
 * applications and appliances.  These contracts have been sold to many    *
 * security vendors, and generally include a perpetual license as well as  *
 * providing for priority support and updates as well as helping to fund   *
 * the continued development of Nmap technology.  Please email             *
 * sales@insecure.com for further information.                             *
 *                                                                         *
 * As a special exception to the GPL terms, Insecure.Com LLC grants        *
 * permission to link the code of this program with any version of the     *
 * OpenSSL library which is distributed under a license identical to that  *
 * listed in the included Copying.OpenSSL file, and distribute linked      *
 * combinations including the two. You must obey the GNU GPL in all        *
 * respects for all of the code used other than OpenSSL.  If you modify    *
 * this file, you may extend this exception to your version of the file,   *
 * but you are not obligated to do so.                                     *
 *                                                                         *
 * If you received these files with a written license agreement or         *
 * contract stating terms other than the terms above, then that            *
 * alternative license agreement takes precedence over these comments.     *
 *                                                                         *
 * Source is provided to this software because we believe users have a     *
 * right to know exactly what a program is going to do before they run it. *
 * This also allows you to audit the software for security holes (none     *
 * have been found so far).                                                *
 *                                                                         *
 * Source code also allows you to port Nmap to new platforms, fix bugs,    *
 * and add new features.  You are highly encouraged to send your changes   *
 * to fyodor@insecure.org for possible incorporation into the main         *
 * distribution.  By sending these changes to Fyodor or one the            *
 * Insecure.Org development mailing lists, it is assumed that you are      *
 * offering Fyodor and Insecure.Com LLC the unlimited, non-exclusive right *
 * to reuse, modify, and relicense the code.  Nmap will always be          *
 * available Open Source, but this is important because the inability to   *
 * relicense code has caused devastating problems for other Free Software  *
 * projects (such as KDE and NASM).  We also occasionally relicense the    *
 * code to third parties as discussed above.  If you wish to specify       *
 * special license conditions of your contributions, just say so when you  *
 * send them.                                                              *
 *                                                                         *
 * This program is distributed in the hope that it will be useful, but     *
 * WITHOUT ANY WARRANTY; without even the implied warranty of              *
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU       *
 * General Public License for more details at                              *
 * http://www.gnu.org/copyleft/gpl.html , or in the COPYING file included  *
 * with Nmap.                                                              *
 *                                                                         *
 ***************************************************************************/

GNU General Public License

----------------------------------------------------------------------------

Table of Contents

   * GNU GENERAL PUBLIC LICENSE
        o Preamble
        o TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
        o How to Apply These Terms to Your New Programs

----------------------------------------------------------------------------

GNU GENERAL PUBLIC LICENSE

Version 2, June 1991

Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place - Suite 330, Boston, MA  02111-1307, USA

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

Preamble

The licenses for most software are designed to take away your freedom to
share and change it. By contrast, the GNU General Public License is intended
to guarantee your freedom to share and change free software--to make sure
the software is free for all its users. This General Public License applies
to most of the Free Software Foundation's software and to any other program
whose authors commit to using it. (Some other Free Software Foundation
software is covered by the GNU Library General Public License instead.) You
can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our
General Public Licenses are designed to make sure that you have the freedom
to distribute copies of free software (and charge for this service if you
wish), that you receive source code or can get it if you want it, that you
can change the software or use pieces of it in new free programs; and that
you know you can do these things.

To protect your rights, we need to make restrictions that forbid anyone to
deny you these rights or to ask you to surrender the rights. These
restrictions translate to certain responsibilities for you if you distribute
copies of the software, or if you modify it.

For example, if you distribute copies of such a program, whether gratis or
for a fee, you must give the recipients all the rights that you have. You
must make sure that they, too, receive or can get the source code. And you
must show them these terms so they know their rights.

We protect your rights with two steps: (1) copyright the software, and (2)
offer you this license which gives you legal permission to copy, distribute
and/or modify the software.

Also, for each author's protection and ours, we want to make certain that
everyone understands that there is no warranty for this free software. If
the software is modified by someone else and passed on, we want its
recipients to know that what they have is not the original, so that any
problems introduced by others will not reflect on the original authors'
reputations.

Finally, any free program is threatened constantly by software patents. We
wish to avoid the danger that redistributors of a free program will
individually obtain patent licenses, in effect making the program
proprietary. To prevent this, we have made it clear that any patent must be
licensed for everyone's free use or not licensed at all.

The precise terms and conditions for copying, distribution and modification
follow.

TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

0. This License applies to any program or other work which contains a notice
placed by the copyright holder saying it may be distributed under the terms
of this General Public License. The "Program", below, refers to any such
program or work, and a "work based on the Program" means either the Program
or any derivative work under copyright law: that is to say, a work
containing the Program or a portion of it, either verbatim or with
modifications and/or translated into another language. (Hereinafter,
translation is included without limitation in the term "modification".) Each
licensee is addressed as "you".

Activities other than copying, distribution and modification are not covered
by this License; they are outside its scope. The act of running the Program
is not restricted, and the output from the Program is covered only if its
contents constitute a work based on the Program (independent of having been
made by running the Program). Whether that is true depends on what the
Program does.

1. You may copy and distribute verbatim copies of the Program's source code
as you receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice and
disclaimer of warranty; keep intact all the notices that refer to this
License and to the absence of any warranty; and give any other recipients of
the Program a copy of this License along with the Program.

You may charge a fee for the physical act of transferring a copy, and you
may at your option offer warranty protection in exchange for a fee.

2. You may modify your copy or copies of the Program or any portion of it,
thus forming a work based on the Program, and copy and distribute such
modifications or work under the terms of Section 1 above, provided that you
also meet all of these conditions:

   * a) You must cause the modified files to carry prominent notices stating
     that you changed the files and the date of any change.

   * b) You must cause any work that you distribute or publish, that in
     whole or in part contains or is derived from the Program or any part
     thereof, to be licensed as a whole at no charge to all third parties
     under the terms of this License.

   * c) If the modified program normally reads commands interactively when
     run, you must cause it, when started running for such interactive use
     in the most ordinary way, to print or display an announcement including
     an appropriate copyright notice and a notice that there is no warranty
     (or else, saying that you provide a warranty) and that users may
     redistribute the program under these conditions, and telling the user
     how to view a copy of this License. (Exception: if the Program itself
     is interactive but does not normally print such an announcement, your
     work based on the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole. If identifiable
sections of that work are not derived from the Program, and can be
reasonably considered independent and separate works in themselves, then
this License, and its terms, do not apply to those sections when you
distribute them as separate works. But when you distribute the same sections
as part of a whole which is a work based on the Program, the distribution of
the whole must be on the terms of this License, whose permissions for other
licensees extend to the entire whole, and thus to each and every part
regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest your
rights to work written entirely by you; rather, the intent is to exercise
the right to control the distribution of derivative or collective works
based on the Program.

In addition, mere aggregation of another work not based on the Program with
the Program (or with a work based on the Program) on a volume of a storage
or distribution medium does not bring the other work under the scope of this
License.

3. You may copy and distribute the Program (or a work based on it, under
Section 2) in object code or executable form under the terms of Sections 1
and 2 above provided that you also do one of the following:

   * a) Accompany it with the complete corresponding machine-readable source
     code, which must be distributed under the terms of Sections 1 and 2
     above on a medium customarily used for software interchange; or,

   * b) Accompany it with a written offer, valid for at least three years,
     to give any third party, for a charge no more than your cost of
     physically performing source distribution, a complete machine-readable
     copy of the corresponding source code, to be distributed under the
     terms of Sections 1 and 2 above on a medium customarily used for
     software interchange; or,

   * c) Accompany it with the information you received as to the offer to
     distribute corresponding source code. (This alternative is allowed only
     for noncommercial distribution and only if you received the program in
     object code or executable form with such an offer, in accord with
     Subsection b above.)

The source code for a work means the preferred form of the work for making
modifications to it. For an executable work, complete source code means all
the source code for all modules it contains, plus any associated interface
definition files, plus the scripts used to control compilation and
installation of the executable. However, as a special exception, the source
code distributed need not include anything that is normally distributed (in
either source or binary form) with the major components (compiler, kernel,
and so on) of the operating system on which the executable runs, unless that
component itself accompanies the executable.

If distribution of executable or object code is made by offering access to
copy from a designated place, then offering equivalent access to copy the
source code from the same place counts as distribution of the source code,
even though third parties are not compelled to copy the source along with
the object code.

4. You may not copy, modify, sublicense, or distribute the Program except as
expressly provided under this License. Any attempt otherwise to copy,
modify, sublicense or distribute the Program is void, and will automatically
terminate your rights under this License. However, parties who have received
copies, or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.

5. You are not required to accept this License, since you have not signed
it. However, nothing else grants you permission to modify or distribute the
Program or its derivative works. These actions are prohibited by law if you
do not accept this License. Therefore, by modifying or distributing the
Program (or any work based on the Program), you indicate your acceptance of
this License to do so, and all its terms and conditions for copying,
distributing or modifying the Program or works based on it.

6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the original
licensor to copy, distribute or modify the Program subject to these terms
and conditions. You may not impose any further restrictions on the
recipients' exercise of the rights granted herein. You are not responsible
for enforcing compliance by third parties to this License.

7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot distribute so
as to satisfy simultaneously your obligations under this License and any
other pertinent obligations, then as a consequence you may not distribute
the Program at all. For example, if a patent license would not permit
royalty-free redistribution of the Program by all those who receive copies
directly or indirectly through you, then the only way you could satisfy both
it and this License would be to refrain entirely from distribution of the
Program.

If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply and
the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any patents
or other property right claims or to contest validity of any such claims;
this section has the sole purpose of protecting the integrity of the free
software distribution system, which is implemented by public license
practices. Many people have made generous contributions to the wide range of
software distributed through that system in reliance on consistent
application of that system; it is up to the author/donor to decide if he or
she is willing to distribute software through any other system and a
licensee cannot impose that choice.

This section is intended to make thoroughly clear what is believed to be a
consequence of the rest of this License.

8. If the distribution and/or use of the Program is restricted in certain
countries either by patents or by copyrighted interfaces, the original
copyright holder who places the Program under this License may add an
explicit geographical distribution limitation excluding those countries, so
that distribution is permitted only in or among countries not thus excluded.
In such case, this License incorporates the limitation as if written in the
body of this License.

9. The Free Software Foundation may publish revised and/or new versions of
the General Public License from time to time. Such new versions will be
similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.

10. If you wish to incorporate parts of the Program into other free programs
whose distribution conditions are different, write to the author to ask for
permission. For software which is copyrighted by the Free Software
Foundation, write to the Free Software Foundation; we sometimes make
exceptions for this. Our decision will be guided by the two goals of
preserving the free status of all derivatives of our free software and of
promoting the sharing and reuse of software generally.

NO WARRANTY

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR
THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO
THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM
PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO
LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR
THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.

END OF TERMS AND CONDITIONS

How to Apply These Terms to Your New Programs

If you develop a new program, and you want it to be of the greatest possible
use to the public, the best way to achieve this is to make it free software
which everyone can redistribute and change under these terms.

To do so, attach the following notices to the program. It is safest to
attach them to the start of each source file to most effectively convey the
exclusion of warranty; and each file should have at least the "copyright"
line and a pointer to where the full notice is found.

one line to give the program's name and an idea of what it does.
Copyright (C) 19yy  name of author

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

Also add information on how to contact you by electronic and paper mail.

If the program is interactive, make it output a short notice like this when
it starts in an interactive mode:

Gnomovision version 69, Copyright (C) 19yy name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details
type `show w'.  This is free software, and you are welcome
to redistribute it under certain conditions; type `show c'
for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may be
called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.

You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:

Yoyodyne, Inc., hereby disclaims all copyright
interest in the program `Gnomovision'
(which makes passes at compilers) written
by James Hacker.

signature of Ty Coon, 1 April 1989
Ty Coon, President of Vice

This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General Public
License instead of this License.
 07070100243fe2000081a40000000a0000000a0000000144fe8f2600001887000000880000000a00000000000000000000001f00000005reloc/doc/nmap/COPYING.OpenSSL    
  LICENSE ISSUES
  ==============

  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
  the OpenSSL License and the original SSLeay license apply to the toolkit.
  See below for the actual license texts. Actually both licenses are BSD-style
  Open Source licenses. In case of any license issues related to OpenSSL
  please contact openssl-core@openssl.org.

  OpenSSL License
  ---------------

/* ====================================================================
 * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

 Original SSLeay License
 -----------------------

/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

 07070100243fe3000081a40000000a0000000a0000000144fe8f2600001011000000880000000a00000000000000000000001700000005reloc/doc/nmap/HACKING    $Id: HACKING 2902 2005-10-10 22:50:45Z fyodor $

Nmap HACKING
------------

Information for potential Nmap hackers!

Source is provided to Nmap because we believe users have a
right to know exactly what a program is going to do before they run
it.  This also allows you to audit the software for security holes
(none have been found so far).

Source code also allows you to port Nmap to new platforms, fix bugs,
and add new features.  You are highly encouraged to send your changes
to fyodor@insecure.org or nmap-dev@insecure.org for possible
incorporation into the main distribution.  By sending these changes to
Fyodor or one the insecure.org development mailing lists, it is
assumed that you are offering Fyodor the unlimited, non-exclusive
right to reuse, modify, and relicense the code.  This is important
because the inability to relicense code has caused devastating
problems for other Free Software projects (such as KDE and NASM).
Nmap will always be available Open Source.  If you wish to specify
special license conditions of your contributions, just say so when you
send them.

Nmap is a community project and has already benefitted greatly from
outside contributors ( for examples, see the CHANGELOG or
http://www.insecure.org/nmap/#thanks ).  Bugfixes, and portability
changes will almost always be accepted.  Even if you do not have time
to track down and patch a problem, bug reports are always welcome.

Hackers interested in something more major, such as a new feature, are
encouraged to send a mail describing their plans to
nmap-dev@insecure.org .  This is a good way to solicit feedback on
your proposals.  List members or often very willing to help.  You
might want to subscribe to that mailing list as well -- send a blank
email to nmap-dev-subscribe@insecure.org .  While you are at it, you
might also want to subscribe to nmap-hackers via the same mechanism.
Web archives of those lists are at http://lists.insecure.org .

If you are not ready to send details of your feature to the whole
list, you can always start by mailing fyodor@insecure.org .

Some ideas of useful contributions/projects
-------------------------------------------

Of course, you are welcome to work on whatever suits your fancy.  But
here are some ideas of contributions that might be particularly
useful:

o Nmap GUI improvements -- I am currently maintaining NmapFE (also known
  as xnmap) -- the GTK GUI front end to Nmap.  I am very open to changes
  and improvements in that program.  If you have enhancement ideas, give
  it a shot!  Alternatively, consider contributing to the NmapGUI and
  UMIT projects available at http://sourceforge.net/projects/nmapgui/
  and http://umit.sourceforge.net/ , respectively.

One of the best ways to help is to join the nmap-dev list
( http://cgi.insecure.org/mailman/listinfo/nmap-dev ).  Requests for
assistance and new Nmap-related projects are often posted there.

How to make code contributions
------------------------------

The preferred mechanism for submitted changes is unified diffs against
the latest development release version of Nmap.  Please send them to
fyodor@insecure.org or nmap-dev@insecure.org .  

To make a unified diff, please follow these instructions:

1. Remove temporary files:
    make clean

2. Rename your source tree:
    cd ..
    mv nmap-2.54BETA4 nmap-2.54BETA4-snazzy-feature

3. Unpack the original Nmap source alongside it:
    tar xzf nmap-2.54BETA4.tgz

4. Generate the diffs:
   diff -urNb nmap-2.54BETA4 nmap-2.54BETA4-snazzy-feature > nmap.patch

5. Check the patch and remove any unnecessary patches from the file.

6. If you've added several features, it's best to send them as
   several independent patches if you can.

If you have just patched one or two files, then making patches is even
easier. For each file, just do:

  cp file.c file.c.orig
  [Make changes to file.c ...]
  diff -u file.c.orig file.c > file.c.patch

and just send us the patch: file.c.patch.


Credits
-------

I got the idea for this HACKING file from GNet 
(http://www.gnetlibrary.org/) and followed the
general structure of their HACKING file.

   07070100243fe4000081a40000000a0000000a0000000144fe8f26000000d7000000880000000a00000000000000000000001700000005reloc/doc/nmap/INSTALL    Ideally, you should be able to just type:

./configure
make
make install

For far more in-depth compilation, installation, and removal notes,
read the Nmap Install Guide at http://www.insecure.org/nmap/install/ .


 07070100243fe5000041ed0000000a0000000a0000000244fe8f2800000000000000880000000a00000000000000000000001400000005reloc/doc/nmap/docs   07070100243fe6000081a40000000a0000000a0000000144fe8f2700000144000000880000000a00000000000000000000001b00000005reloc/doc/nmap/docs/README    Here are the docs for nmap.  You would be better
off checking the website at http://www.insecure.org/nmap
for the latest information.  Also if the man page is installed
correctly you should be able to 'man nmap'.  The man page is more 
up-to-date than the article.  See nmap-manpage.html for an html version
of it.

-Fyodor
07070100243fe7000081a40000000a0000000a0000000144fe8f260000044c000000880000000a00000000000000000000002c00000005reloc/doc/nmap/docs/leet-nmap-ascii-art.txt     (  )   /\   _                 (     
    \ |  (  \ ( \.(               )                      _____
  \  \ \  `  `   ) \             (  ___                 / _   \
 (_`    \+   . x  ( .\            \/   \____-----------/ (o)   \_
- .-               \+  ;          (  O                           \____
                          )        \_____________  `              \  /
(__                +- .( -'.- <. - _  VVVVVVV VV V\                 \/
(_____            ._._: <_ - <- _  (--  _AAAAAAA__A_/                |
  .    /./.+-  . .- /  +--  - .     \______________//_              \_______
  (__ ' /x  / x _/ (                                  \___'          \     /
 , x / ( '  . / .  /                                      |           \   /
    /  /  _/ /    +                                      /              \/
   '  (__/                                             /                  \
             NMAP IS A POWERFUL TOOL -- USE CAREFULLY AND REPONSIBLY
              [ Sick of the Nmap dragon? Submit your art and tag ]
              [ lines to nmap-dev@insecure.org for next release! ]
07070100243fe8000081a40000000a0000000a0000000144fe8f260002a5cf000000880000000a00000000000000000000002100000005reloc/doc/nmap/docs/nmap-man.xml  <?xml version="1.0"?>
<!-- $Id: manhtml.xml 3244 2006-03-29 08:44:10Z fyodor $ -->
<article id="man">
<artheader>
  <title>Nmap Reference Guide (Man Page)</title>
</artheader>
<refentry id="man-nmap1">
  <refmeta>
    <refentrytitle>nmap</refentrytitle>
    <manvolnum>1</manvolnum>
  </refmeta>
  <refnamediv id="man-name">
    <refname>nmap</refname>
    <refpurpose>Network exploration tool and security / port scanner</refpurpose>
  </refnamediv>
  <!-- body begins here -->
  <refsynopsisdiv id="man-synopsis">
    <cmdsynopsis sepchar=" ">
      <command moreinfo="none">nmap</command>
      <arg choice="opt" rep="repeat">
        <replaceable>Scan Type</replaceable>
      </arg>
      <arg choice="opt" rep="norepeat">
        <replaceable>Options</replaceable>
      </arg>
      <arg choice="req" rep="norepeat">
        <replaceable>target specification</replaceable>
      </arg>
    </cmdsynopsis>
  </refsynopsisdiv>
  <refsect1 id="man-description">
    <title>Description</title>

    <para>Nmap (<quote>Network Mapper</quote>) is an open source tool for network
    exploration and security auditing.  It was designed to rapidly
    scan large networks, although it works fine against single
    hosts. Nmap uses raw IP packets in novel ways to determine what
    hosts are available on the network, what services (application
    name and version) those hosts are offering, what operating systems
    (and OS versions) they are running, what type of packet
    filters/firewalls are in use, and dozens of other
    characteristics.  While Nmap is commonly used for security audits,
    many systems and network administrators find it useful for routine
    tasks such as network inventory, managing service upgrade
    schedules, and monitoring host or service uptime.</para>

    <para>The output from Nmap is a list of scanned targets, with
    supplemental information on each depending on the options
    used. Key among that information is the <quote>interesting ports
    table</quote>.  That table lists the port number and protocol,
    service name, and state.  The state is either
    <literal moreinfo="none">open</literal>, <literal moreinfo="none">filtered</literal>,
    <literal moreinfo="none">closed</literal>, or <literal moreinfo="none">unfiltered</literal>. Open
    means that an application on the target machine is listening for
    connections/packets on that port. <literal moreinfo="none">Filtered</literal> means that a firewall,
    filter, or other network obstacle is blocking the port so that
    Nmap cannot tell whether it is <literal moreinfo="none">open</literal> or <literal moreinfo="none">closed</literal>.  <literal moreinfo="none">Closed</literal> ports have
    no application listening on them, though they could open up at any
    time.  Ports are classified as <literal moreinfo="none">unfiltered</literal> when they are responsive
    to Nmap's probes, but Nmap cannot determine whether they are open
    or closed.  Nmap reports the state combinations
    <literal moreinfo="none">open|filtered</literal> and
    <literal moreinfo="none">closed|filtered</literal> when it cannot determine which
    of the two states describe a port.  The port table may also
    include software version details when version detection has been
    requested.  When an IP protocol scan is requested
    (<option>-sO</option>), Nmap provides information on supported IP
    protocols rather than listening ports.</para>

    <para>In addition to the interesting ports table, Nmap can provide
    further information on targets, including reverse DNS names,
    operating system guesses, device types, and MAC addresses.</para>

    <para>A typical Nmap scan is shown in <xref linkend="man-ex-repscan"/>.  The only Nmap arguments used in
    this example are <option>-A</option>, to enable OS and version
    detection, <option>-T4</option> for faster execution, and then the
    two target hostnames.</para>

<example id="man-ex-repscan"><title>A representative Nmap scan</title>
<screen format="linespecific">
# nmap -A -T4 scanme.nmap.org playground

Starting nmap ( http://www.insecure.org/nmap/ )
Interesting ports on scanme.nmap.org (205.217.153.62):
(The 1663 ports scanned but not shown below are in state: filtered)
PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 3.9p1 (protocol 1.99)
53/tcp  open   domain
70/tcp  closed gopher
80/tcp  open   http    Apache httpd 2.0.52 ((Fedora))
113/tcp closed auth
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.7 - 2.6.11, Linux 2.6.0 - 2.6.11
Uptime 33.908 days (since Thu Jul 21 03:38:03 2005)

Interesting ports on playground.nmap.org (192.168.0.40):
(The 1659 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn
389/tcp  open  ldap?
445/tcp  open  microsoft-ds  Microsoft Windows XP microsoft-ds
1002/tcp open  windows-icfw?
1025/tcp open  msrpc         Microsoft Windows RPC
1720/tcp open  H.323/Q.931   CompTek AquaGateKeeper
5800/tcp open  vnc-http      RealVNC 4.0 (Resolution 400x250; VNC TCP port: 5900)
5900/tcp open  vnc           VNC (protocol 3.8)
MAC Address: 00:A0:CC:63:85:4B (Lite-on Communications)
Device type: general purpose
Running: Microsoft Windows NT/2K/XP
OS details: Microsoft Windows XP Pro RC1+ through final release
Service Info: OSs: Windows, Windows XP

Nmap finished: 2 IP addresses (2 hosts up) scanned in 88.392 seconds
</screen>
</example>

<para>The newest version of Nmap can be obtained from <ulink url="http://www.insecure.org/nmap/"/>.  The newest version of the man
page is available from <ulink url="http://www.insecure.org/nmap/man/"/>.</para>

  </refsect1>

  <refsect1 id="man-briefoptions">
    <title>Options Summary</title>

<para>This options summary is printed when Nmap is run
with no arguments, and the latest version is always available at
<ulink url="http://www.insecure.org/nmap/data/nmap.usage.txt"/>.
It helps people remember the most common options, but is no
substitute for the in-depth documentation in the rest of this
manual.  Some obscure options aren't even included here.</para>

<para>
<literallayout format="linespecific" class="normal">Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL &lt;inputfilename&gt;: Input from list of hosts/networks
  -iR &lt;num hosts&gt;: Choose random targets
  --exclude &lt;host1[,host2][,host3],...&gt;: Exclude hosts/networks
  --excludefile &lt;exclude_file&gt;: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sP: Ping Scan - go no further than determining if host is online
  -P0: Treat all hosts as online -- skip host discovery
  -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers &lt;serv1[,serv2],...&gt;: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags &lt;flags&gt;: Customize TCP scan flags
  -sI &lt;zombie host[:probeport]&gt;: Idlescan
  -sO: IP protocol scan
  -b &lt;ftp relay host&gt;: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p &lt;port ranges&gt;: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
  -F: Fast - Scan only the ports listed in the nmap-services file)
  -r: Scan ports consecutively - don't randomize
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity &lt;level&gt;: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take &lt;time&gt; are in milliseconds, unless you append 's'
  (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T[0-5]: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup &lt;size&gt;: Parallel host scan group sizes
  --min-parallelism/max-parallelism &lt;time&gt;: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout &lt;time&gt;: Specifies
      probe round trip time.
  --max-retries &lt;tries&gt;: Caps number of port scan probe retransmissions.
  --host-timeout &lt;time&gt;: Give up on target after this long
  --scan-delay/--max-scan-delay &lt;time&gt;: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu &lt;val&gt;: fragment packets (optionally w/given MTU)
  -D &lt;decoy1,decoy2[,ME],...&gt;: Cloak a scan with decoys
  -S &lt;IP_Address&gt;: Spoof source address
  -e &lt;iface&gt;: Use specified interface
  -g/--source-port &lt;portnum&gt;: Use given port number
  --data-length &lt;num&gt;: Append random data to sent packets
  --ttl &lt;val&gt;: Set IP time-to-live field
  --spoof-mac &lt;mac address/prefix/vendor name&gt;: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP checksum
OUTPUT:
  -oN/-oX/-oS/-oG &lt;file&gt;: Output scan in normal, XML, s|&lt;rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA &lt;basename&gt;: Output in the three major formats at once
  -v: Increase verbosity level (use twice for more effect)
  -d[level]: Set or increase debugging level (Up to 9 is meaningful)
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --log-errors: Log errors/warnings to the normal-format output file
  --append-output: Append to rather than clobber specified output files
  --resume &lt;filename&gt;: Resume an aborted scan
  --stylesheet &lt;path/URL&gt;: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Insecure.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enables OS detection and Version detection
  --datadir &lt;dirname&gt;: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sP 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -P0 -p 80
</literallayout>

</para>

  </refsect1>

  <refsect1 id="man-target-specification">
    <title>Target Specification</title>

<para>Everything on the Nmap command-line that isn't an option (or
option argument) is treated as a target host specification.  The
simplest case is to specify a target IP address or hostname for scanning.</para>

<para>Sometimes you wish to scan a whole network of adjacent hosts.
For this, Nmap supports CIDR-style addressing.  You can append
<indexterm significance="normal"><primary>CIDR addressing</primary></indexterm>
/<replaceable>numbits</replaceable> to an IP address or hostname and
Nmap will scan every IP address for which the first
<replaceable>numbits</replaceable> are the same as for the reference
IP or hostname given.  For example, 192.168.10.0/24 would scan the 256
hosts between 192.168.10.0 (binary: <literal moreinfo="none">11000000 10101000
00001010 00000000</literal>) and 192.168.10.255 (binary: <literal moreinfo="none">11000000 10101000
00001010 11111111</literal>), inclusive.
192.168.10.40/24 would do exactly the same thing.  Given that the host
scanme.nmap.org is at the IP address 205.217.153.62, the specification
scanme.nmap.org/16 would scan the 65,536 IP addresses between
205.217.0.0 and 205.217.255.255.  The smallest allowed value is /1,
which scans half the Internet.  The largest value is 32, which scans
just the named host or IP address because all address bits are fixed.</para>

<para>CIDR notation is short but not always flexible enough.  For example, you
might want to scan 192.168.0.0/16 but skip any IPs ending with .0 or
.255 because they are commonly broadcast addresses.  Nmap supports
this through octet range addressing.  Rather than specify a normal IP
address, you can specify a comma separated list of numbers or ranges
for each octet.  For example, 192.168.0-255.1-254 will skip all
addresses in the range that end in .0 and or .255.  Ranges need not be
limited to the final octects: the specifier
0-255.0-255.13.37 will perform an Internet-wide scan for all IP
addresses ending in 13.37.  This sort of broad sampling can be useful
for Internet surveys and research.</para>

<para>IPv6 addresses can only be specified by their fully qualified IPv6
address or hostname.  CIDR and octet ranges aren't supported for
IPv6 because they are rarely useful.</para>

<para>Nmap accepts multiple host specifications on the command line,
and they don't need to be the same type.  The command <command moreinfo="none">nmap
scanme.nmap.org 192.168.0.0/16 10.0.0,1,3-7.0-255</command> does what
you would expect.</para>

<para>While targets are usually specified on the command lines, the following options are also available to control target selection:</para>

    <variablelist>
      <varlistentry>
        <term>
          <option>-iL &lt;inputfilename&gt;</option> (Input from list)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-iL</primary></indexterm>
          <para>Reads target specifications from
          <replaceable>inputfilename</replaceable>.  Passing a huge
          list of hosts is often awkward on the command line, yet it
          is a common desire.  For example, your DHCP server might
          export a list of 10,000 current leases that you wish to
          scan.  Or maybe you want to scan all IP addresses
          <emphasis>except</emphasis> for those to locate hosts using
          unauthorized static IP addresses.  Simply generate the list
          of hosts to scan and pass that filename to Nmap as an
          argument to the <option>-iL</option> option.  Entries can be
          in any of the formats accepted by Nmap on the command line
          (IP address, hostname, CIDR, IPv6, or octet ranges).  Each
          entry must be separated by one or more spaces, tabs, or
          newlines.  You can specify a hyphen (<literal moreinfo="none">-</literal>)
          as the filename if you want Nmap to read hosts from standard
          input rather than an actual file.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-iR &lt;num hosts&gt;</option> (Choose random targets)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-iR</primary></indexterm>
          <para>For Internet-wide surveys
          and other research, you may want to choose targets at
          random.  The <replaceable>num hosts</replaceable> argument
          tells Nmap how many IPs to generate.  Undesirable IPs such
          as those in certain private, multicast, or unallocated
          address ranges are automatically skipped.  The argument <literal moreinfo="none">0</literal>
          can be specified for a never-ending scan.  Keep in mind that
          some network administrators bristle at unauthorized scans of
          their networks and may complain.  Use this option at your
          own risk!  If you find yourself really bored one rainy
          afternoon, try the command <command moreinfo="none">nmap -sS -PS80 -iR 0 -p
          80</command> to locate random web servers for
          browsing.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--exclude
          &lt;host1[,host2][,host3],...&gt;</option> (Exclude hosts/networks)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--exclude</primary></indexterm>
          <para>Specifies a comma-separated list of targets to be
          excluded from the scan even if they are part of the overall
          network range you specify.  The list you pass in uses normal
          Nmap syntax, so it can include hostnames, CIDR netblocks,
          octet ranges, etc.  This can be useful when the network you
          wish to scan includes untouchable mission-critical servers,
          systems that are known to react adversely to port scans,
          or subnetworks administered by other people.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--excludefile &lt;exclude_file&gt;</option> (Exclude list from file)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--excludefile</primary></indexterm>
          <para>This offers the same functionality as the <option>--exclude</option>
          option, except that the excluded targets are provided in a
          newline, space, or tab delimited
          <replaceable>exclude_file</replaceable> rather than on the
          command line.</para>
        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1 id="man-host-discovery">
    <title>Host Discovery</title>
 
   <para>One of the very first steps in any network reconnaissance
    mission is to reduce a (sometimes huge) set of IP ranges into a
    list of active or interesting hosts. Scanning every port of
    every single IP address is slow and usually unnecessary. Of
    course what makes a host interesting depends greatly on the
    scan purposes. Network administrators may only be interested in
    hosts running a certain service, while security auditors may
    care about every single device with an IP address. An
    administrator may be comfortable using just an ICMP ping to
    locate hosts on his internal network, while an external
    penetration tester may use a diverse set of dozens of probes in
    an attempt to evade firewall restrictions.</para>

    <para>Because host discovery needs are so diverse, Nmap offers a
    wide variety of options for customizing the techniques used. Host
    discovery is sometimes called ping scan, but it goes well beyond
    the simple ICMP echo request packets associated with the
    ubiquitous <application moreinfo="none">ping</application> tool. Users can skip
    the ping step entirely with a list scan (<option>-sL</option>) or
    by disabling ping (<option>-P0</option>), or engage the network
    with arbitrary combinations of multi-port TCP SYN/ACK, UDP, and
    ICMP probes. The goal of these probes is to solicit responses
    which demonstrate that an IP address is actually active (is being
    used by a host or network device). On many networks, only a small
    percentage of IP addresses are active at any given time. This is
    particularly common with RFC1918-blessed private address space
    such as 10.0.0.0/8. That network has 16 million IPs, but I have
    seen it used by companies with less than a thousand machines. Host
    discovery can find those machines in a sparsely allocated sea of
    IP addresses.</para>

    <para>If no host discovery options are given, Nmap
          sends a TCP ACK
          packet destined for port 80 and an ICMP Echo Request query
          to each target machine.  An exception to this is that an ARP scan is
          used for any targets which are on a local ethernet network.
          For unprivileged UNIX shell users, a SYN packet is sent
          instead of the ack using the <function moreinfo="none">connect()</function>
          system call.  These defaults are equivalent to the
          <option>-PA -PE</option> options.  This host discovery is
          often sufficient when scanning local networks, but a more
          comprehensive set of discovery probes is recommended for
          security auditing.</para>
    
    <para>The <option>-P*</option> options (which select
    ping types) can be combined.  You can increase your odds of
    penetrating strict firewalls by sending many probe types using
    different TCP ports/flags and ICMP codes.  Also note that ARP
    discovery (<option>-PR</option>) is done by default against
    targets on a local ethernet network even if you specify other
    <option>-P*</option> options, because it is almost always faster
    and more effective.</para>

    <para>By default, Nmap does host discovery and then performs a
    port scan against each host it determines is online.  This is true
    even if you specify non-default host discovery types such as UDP
    probes (<option>-PU</option>).  Read about the
    <option>-sP</option> option to learn how to perform
    <emphasis>only</emphasis> host discovery, or use
    <option>-P0</option> to skip host discovery and port scan all
    target hosts.  The following options control host
    discovery:</para>

    <variablelist>

      <varlistentry>
        <term>
        <option>-sL</option> (List Scan)</term>
        <listitem>
          <indexterm significance="normal"><primary>-sL</primary></indexterm>
          <indexterm significance="normal"><primary>List scan</primary></indexterm>
          <para>The list scan is a degenerate form of host discovery
          that simply lists each host of the network(s) specified,
          without sending any packets to the target hosts.  By
          default, Nmap still does reverse-DNS resolution on the hosts
          to learn their names.  It is often surprising how much
          useful information simple hostnames give out.  For example,
          <literal moreinfo="none">fw.chi.playboy.com</literal> is the firewall for the Chicago office of
          Playboy Enterprises.  Nmap also reports the total number of
          IP addresses at the end.  The list scan is a good sanity
          check to ensure that you have proper IP addresses for your
          targets.  If the hosts sport domain names you do not
          recognize, it is worth investigating further to prevent
          scanning the wrong company's network.</para>

          <para>Since the idea is to simply print a list of target
          hosts, options for higher level functionality such as port
          scanning, OS detection, or ping scanning cannot be combined
          with this.  If you wish to disable ping scanning while still
          performing such higher level functionality, read up on the
          <option>-P0</option> option.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sP</option> (Ping Scan)</term>
        <listitem>

           <para>This option tells Nmap to <emphasis>only</emphasis>
           <indexterm significance="normal"><primary>-sP</primary></indexterm>
           <indexterm significance="normal"><primary>Ping scan</primary></indexterm>
           perform a ping scan (host discovery), then print out the available hosts
           that responded to the scan.  No further testing (such as
           port scanning or OS detection) is performed.  This is one
           step more intrusive than the list scan, and can often be
           used for the same purposes.  It allows light reconnaissance
           of a target network without attracting much attention.
           Knowing how many hosts are up is more valuable to attackers
           than the list provided by list scan of every single IP and host name.</para>

           <para>Systems administrators often find this option
           valuable as well.  It can easily be used to count available
           machines on a network or monitor server availability.  This
           is often called a ping sweep, and is more reliable than
           pinging the broadcast address because many hosts do not
           reply to broadcast queries.</para>

           <para>The <option>-sP</option> option sends an ICMP echo
           request and a TCP packet to port 80 by default.  When
           executed by an unprivileged user, a SYN packet is sent
           (using a <function moreinfo="none">connect()</function> call) to port 80 on
           the target.  When a privileged user tries to scan targets
           on a local ethernet network, ARP requests
           (<option>-PR</option>) are used unless
           <option>--send-ip</option> was specified.
           The <option>-sP</option> option can be combined with any of the
           discovery probe types (the <option>-P*</option> options,
           excluding <option>-P0</option>) for greater flexibility.
           If any of those probe type and port number options are
           used, the default probes (ACK and echo request) are
           overridden.  When strict firewalls are in place between the
           source host running Nmap and the target network, using
           those advanced techniques is recommended.  Otherwise hosts
           could be missed when the firewall drops probes or their
           responses.</para>

        </listitem>
      </varlistentry>


      <varlistentry>
        <term>
          <option>-P0</option> (No ping)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-P0</primary></indexterm>
          <para>This option skips the Nmap discovery stage altogether.
          Normally, Nmap uses this stage to determine active machines
          for heavier scanning.  By default, Nmap only performs heavy
          probing such as port scans, version detection, or OS
          detection against hosts that are found to be up.  Disabling
          host discovery with <option>-P0</option> causes Nmap to
          attempt the requested scanning functions against
          <emphasis>every</emphasis> target IP address specified.  So
          if a class B sized target address space (/16) is specified
          on the command line, all 65,536 IP addresses are scanned.
          That second option character in <option>-P0</option> is a
          zero and not the letter O.  Proper host discovery is skipped
          as with the list scan, but instead of stopping and printing
          the target list, Nmap continues to perform requested
          functions as if each target IP is active.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-PS [portlist]</option> (TCP SYN Ping)</term>
        <listitem>

          <indexterm significance="normal"><primary>-PS</primary></indexterm>
          <indexterm significance="normal"><primary>SYN ping</primary></indexterm>
          <para>This option sends an empty TCP packet with the SYN
          flag set.  The default destination port is 80 (configurable
          at compile time by changing DEFAULT_TCP_PROBE_PORT in
          <filename moreinfo="none">nmap.h</filename>), but an alternate port can be
          specified as a parameter.  A comma separated list of ports
          can even be specified
          (e.g. <option>-PS22,23,25,80,113,1050,35000</option>), in
          which case probes will be attempted against each port in
          parallel.</para>

          <para>The SYN flag suggests to the remote system that you
          are attempting to establish a connection.  Normally the
          destination port will be closed, and a RST (reset) packet
          sent back.  If the port happens to be open, the target will
          take the second step of a TCP 3-way-handshake by responding
          with a SYN/ACK TCP packet. The machine running Nmap then
          tears down the nascent connection by responding with a RST
          rather than sending an ACK packet which would complete the
          3-way-handshake and establish a full
          connection.  The RST packet is sent by the
          kernel of the machine running Nmap in response to the
          unexpected SYN/ACK, not by Nmap itself.</para>

          <para>Nmap does not care whether the port is open or closed.
          Either the RST or SYN/ACK response discussed previously tell
          Nmap that the host is available and responsive.</para>

          <para>On UNIX boxes, only the privileged user
          <literal moreinfo="none">root</literal> is generally able to send and
          receive raw TCP packets.  For unprivileged users, a
          workaround is automatically employed whereby the connect()
          system call is initiated against each target port.  This has
          the effect of sending a SYN packet to the target host, in an
          attempt to establish a connection.  If connect() returns
          with a quick success or an ECONNREFUSED failure, the
          underlying TCP stack must have received a SYN/ACK or RST and
          the host is marked available.  If the connection attempt
          is left hanging until a timeout is reached, the host is
          marked as down.  This workaround is also used for IPv6
          connections, as raw IPv6 packet building support is not yet
          available in Nmap.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-PA [portlist]</option> (TCP ACK Ping)</term>
        <listitem>
          <indexterm significance="normal"><primary>-PA</primary></indexterm>
          <indexterm significance="normal"><primary>ACK ping</primary></indexterm>
          <para>The TCP ACK ping is quite similar to the
          just-discussed SYN ping.  The difference, as you could
          likely guess, is that the TCP ACK flag is set instead of the
          SYN flag.  Such an ACK packet purports to be acknowledging
          data over an established TCP connection, but no such
          connection exists.  So remote hosts should always respond
          with a RST packet, disclosing their existence in the
          process.</para>

          <para>The <option>-PA</option> option uses the same default
          port as the SYN probe (80) and can also take a list of
          destination ports in the same format.  If an unprivileged
          user tries this, or an IPv6 target is specified, the
          connect() workaround discussed previously is used.  This
          workaround is imperfect because connect() is actually
          sending a SYN packet rather than an ACK.</para>

          <para>The reason for offering both SYN and ACK ping probes
          is to maximize the chances of bypassing firewalls.  Many
          administrators configure routers and other simple firewalls
          to block incoming SYN packets except for those destined for
          public services like the company web site or mail server.
          This prevents other incoming connections to the
          organization, while allowing users to make unobstructed
          outgoing connections to the Internet.  This non-stateful
          approach takes up few resources on the firewall/router and
          is widely supported by hardware and software filters.  The
          Linux Netfilter/iptables firewall software offers the
          <option>--syn</option> convenience option to implement this
          stateless approach.  When stateless firewall rules such as
          this are in place, SYN ping probes (<option>-PS</option>)
          are likely to be blocked when sent to closed target ports.
          In such cases, the ACK probe shines as it cuts right through
          these rules.</para>

          <para>Another common type of firewall uses stateful rules
          that drop unexpected packets.  This feature was initially
          found mostly on high-end firewalls, though it has become
          much more common over the years.  The Linux
          Netfilter/iptables system supports this through the
          <option>--state</option> option, which categorizes packets
          based on connection state.  A SYN probe is more likely to
          work against such a system, as unexpected ACK packets are
          generally recognized as bogus and dropped.  A solution to this quandary is
          to send both SYN and ACK probes by specifying
          <option>-PS</option> and <option>-PA</option>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-PU [portlist]</option> (UDP Ping)</term>
        <listitem>

          <indexterm significance="normal"><primary>-PU</primary></indexterm>
          <indexterm significance="normal"><primary>UDP ping</primary></indexterm>
          <para>Another host discovery option is the UDP ping, which
          sends an empty (unless <option>--data-length</option> is
          specified) UDP packet to the given ports.  The portlist
          takes the same format as with the previously discussed
          <option>-PS</option> and <option>-PA</option> options.  If
          no ports are specified, the default is 31338.  This default
          can be configured at compile-time by changing
          DEFAULT_UDP_PROBE_PORT in <filename moreinfo="none">nmap.h</filename>.  A
          highly uncommon port is used by default because sending to
          open ports is often undesirable for this particular scan
          type.</para>

          <para>Upon hitting a closed port on the target machine, the
          UDP probe should elicit an ICMP port unreachable packet in
          return.  This signifies to Nmap that the machine is up and
          available.  Many other types of ICMP errors, such as
          host/network unreachables or TTL exceeded are indicative of
          a down or unreachable host.  A lack of response is also
          interpreted this way.  If an open port is reached, most
          services simply ignore the empty packet and fail to return
          any response.  This is why the default probe port is 31338,
          which is highly unlikely to be in use.  A few services, such
          as chargen, will respond to an empty UDP packet, and thus
          disclose to Nmap that the machine is available.</para>

          <para>The primary advantage of this scan type is that it
          bypasses firewalls and filters that only screen TCP.  For
          example, I once owned a Linksys BEFW11S4 wireless broadband
          router.  The external interface of this device filtered all
          TCP ports by default, but UDP probes would still elicit port
          unreachable messages and thus give away the device.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-PE</option>;
        <option>-PP</option>;
        <option>-PM</option> (ICMP Ping Types)</term>
        <listitem>

          <indexterm significance="normal"><primary>-PE</primary></indexterm>
          <indexterm significance="normal"><primary>-PP</primary></indexterm>
          <indexterm significance="normal"><primary>-PM</primary></indexterm>
          <indexterm significance="normal"><primary>ICMP ping</primary></indexterm>
          <para>In addition to the unusual TCP and UDP host discovery
          types discussed previously, Nmap can send the standard
          packets sent by the ubiquitous
          <application moreinfo="none">ping</application> program.  Nmap sends an ICMP
          type 8 (echo request) packet to the target IP addresses,
          expecting a type 0 (Echo Reply) in return from available
          hosts.  Unfortunately for network explorers, many hosts and
          firewalls now block these packets, rather than responding as
          required by <ulink url="http://www.rfc-editor.org/rfc/rfc1122.txt">RFC
          1122</ulink>.  For this reason, ICMP-only scans are rarely
          reliable enough against unknown targets over the Internet.
          But for system administrators monitoring an internal
          network, they can be a practical and efficient approach.
          Use the <option>-PE</option> option to enable this echo
          request behavior.</para>

          <para>While echo request is the standard ICMP ping query,
          Nmap does not stop there.  The ICMP standard (<ulink url="http://www.rfc-editor.org/rfc/rfc792.txt">RFC
          792</ulink>) also specifies timestamp request, information
          request, and address mask request packets as codes 13, 15,
          and 17, respectively.  While the ostensible purpose for
          these queries is to learn information such as address masks
          and current times, they can easily be used for host
          discovery.  A system that replies is up and available.  Nmap
          does not currently implement information request packets, as
          they are not widely supported.  RFC 1122 insists that
          <quote>a host SHOULD NOT implement these messages</quote>.
          Timestamp and address mask queries can be sent with the
          <option>-PP</option> and <option>-PM</option> options,
          respectively.  A timestamp reply (ICMP code 14) or address
          mask reply (code 18) discloses that the host is available.
          These two queries can be valuable when admins specifically
          block echo request packets while forgetting that other ICMP
          queries can be used for the same purpose.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-PR</option> (ARP Ping)</term>
        <listitem>

          <indexterm significance="normal"><primary>-PR</primary></indexterm>
          <indexterm significance="normal"><primary>ARP ping</primary></indexterm>
          <para>One of the most common Nmap usage scenarios is to scan
          an ethernet LAN. On most LANs, especially those using
          RFC1918-blessed private address ranges, the vast majority of
          IP addresses are unused at any given time.  When Nmap tries
          to send a raw IP packet such as an ICMP echo request, the
          operating system must determine the destination hardware
          (ARP) address corresponding to the target IP so that it can
          properly address the ethernet frame.  This is often slow and
          problematic, since operating systems weren't written with
          the expectation that they would need to do millions of ARP
          requests against unavailable hosts in a short time
          period.</para>

          <para>ARP scan puts Nmap and its optimized algorithms in
          charge of ARP requests.  And if it gets a response back,
          Nmap doesn't even need to worry about the IP-based ping
          packets since it already knows the host is up.  This makes
          ARP scan much faster and more reliable than IP-based scans.
          So it is done by default when scanning ethernet hosts that Nmap
          detects are on a local ethernet network.  Even if different
          ping types (such as <option>-PE</option> or
          <option>-PS</option>) are specified, Nmap uses ARP instead
          for any of the targets which are on the same LAN.  If you
          absolutely don't want to do an ARP scan, specify
          <option>--send-ip</option>.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-n</option> (No DNS resolution)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-n</primary></indexterm>
          <para>Tells Nmap to 
          <emphasis>never</emphasis> do reverse DNS
          resolution on the active IP addresses it finds. Since DNS
          is often slow, this speeds things up.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-R</option> (DNS resolution for all targets)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-R</primary></indexterm>
          <para>Tells Nmap to 
          <emphasis>always</emphasis> do reverse DNS
          resolution on the target IP addresses. Normally this is
          only performed when a machine is found to be alive.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--system-dns</option> (Use system DNS resolver)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--system-dns</primary></indexterm>
          <para>By default, Nmap resolves IP addresses by sending
          queries directly to the name servers configured on your host
          and then listening for responses.  Many requests (often
          dozens) are performed in parallel for performance.  Specify
          this option if you wish to use your system resolver instead
          (one IP at a time via the getnameinfo() call).  This is
          slower and rarely useful unless there is a bug in the Nmap
          DNS code -- please contact us if that is the case.  The
          system resolver is always used for IPv6 scans.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--dns-servers &lt;server1[,server2],...&gt;
          </option> (Servers to use for reverse DNS queries)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--dns-servers</primary></indexterm>

          <para>By default Nmap will try to determine your DNS servers
          (for rDNS resolution) from your resolv.conf file (UNIX) or
          the registry (Win32).  Alternatively, you may use this
          option to specify alternate servers.  This option is not
          honored if you are using <option>--system-dns</option> or an
          IPv6 scan. Using multiple DNS servers is often faster and
          more stealthy than querying just one.  The best performance
          is often obtained by specifying all of the authoritative
          servers for the target IP space.</para>

        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1 id="man-port-scanning-basics">
    <title>Port Scanning Basics</title>

          <para>While Nmap has grown in functionality over the years,
          it began as an efficient port scanner, and that remains its
          core function.  The simple command <command moreinfo="none">nmap
          <replaceable>target</replaceable></command> scans more than
          1660 TCP ports on the host
          <replaceable>target</replaceable>.  While many port scanners
          have traditionally lumped all ports into the open or closed
          states, Nmap is much more granular.  It divides ports into
          six states: <literal moreinfo="none">open</literal>,
          <literal moreinfo="none">closed</literal>, <literal moreinfo="none">filtered</literal>,
          <literal moreinfo="none">unfiltered</literal>,
          <literal moreinfo="none">open|filtered</literal>, or
          <literal moreinfo="none">closed|filtered</literal>.</para>

<para>These states are not intrinsic
properties of the port itself, but describe how Nmap sees them.  For
example, an Nmap scan from the same network as the target may show
port 135/tcp as open, while a scan at the same time with the same
options from across the Internet might show that port as <literal moreinfo="none">filtered</literal>.</para>

<variablelist><title>The six port states recognized by Nmap</title>

  <varlistentry><term>open</term>
  <listitem><para>An application is actively accepting TCP
  connections or UDP packets on this port.  Finding these is often the
  primary goal of port scanning.  Security-minded people know that
  each open port is an avenue for attack.  Attackers and pen-testers
  want to exploit the open ports, while administrators try to close or
  protect them with firewalls without thwarting legitimate users.
  Open ports are also interesting for non-security scans because they show
  services available for use on the network.
  </para></listitem></varlistentry>

  <varlistentry><term>closed</term>

  <listitem><para>A closed port is accessible (it receives and
  responds to Nmap probe packets), but there is no application
  listening on it.  They can be helpful in showing that a host is up
  on an IP address (host discovery, or ping scanning), and as part
  of OS detection.  Because closed ports are reachable, it may be
  worth scanning later in case some open up.  Administrators may want
  to consider blocking such ports with a firewall.  Then they would
  appear in the filtered state, discussed next.
  </para></listitem></varlistentry>

  <varlistentry><term>filtered</term>

  <listitem><para>Nmap cannot determine whether the port is open
  because packet filtering prevents its probes from reaching the port.
  The filtering could be from a dedicated firewall device, router
  rules, or host-based firewall software.  These ports frustrate
  attackers because they provide so little information.  Sometimes
  they respond with ICMP error messages such as type 3 code 13
  (destination unreachable: communication administratively
  prohibited), but filters that simply drop probes without responding
  are far more common.  This forces Nmap to retry several times just
  in case the probe was dropped due to network congestion rather than
  filtering.  This slows down the scan dramatically.</para></listitem></varlistentry>

  <varlistentry><term>unfiltered</term>
  <listitem><para>The unfiltered state means that a port is accessible,
  but Nmap is unable to determine whether it is open or closed.  Only
  the ACK scan, which is used to map firewall rulesets, classifies
  ports into this state.  Scanning unfiltered ports with other scan
  types such as Window scan, SYN scan, or FIN scan, may help resolve
  whether the port is open.
  </para></listitem></varlistentry>

  <varlistentry><term>open|filtered</term>
  <listitem><para>Nmap places ports in this state when it is unable to
  determine whether a port is open or filtered.  This occurs for scan
  types in which open ports give no response.  The lack of
  response could also mean that a packet filter dropped the probe or
  any response it elicited.  So Nmap does not know for sure whether
  the port is open or being filtered.  The UDP, IP Protocol,
  FIN, Null, and Xmas scans classify ports this
  way.</para></listitem></varlistentry>

  <varlistentry><term>closed|filtered</term>
  <listitem><para>This state is used when Nmap is unable to determine
  whether a port is closed or filtered.  It is only used for the IPID
  Idle scan.</para></listitem></varlistentry>
  </variablelist>
</refsect1>

<refsect1 id="man-port-scanning-techniques">
  <title>Port Scanning Techniques</title>

<para>As a novice performing automotive repair, I can struggle
for hours trying to fit my rudimentary tools (hammer, duct tape,
wrench, etc.)  to the task at hand.  When I fail miserably and tow my
jalopy to a real mechanic, he invariably fishes around in a huge tool chest until
pulling out the perfect gizmo which makes the job seem effortless.  The
art of port scanning is similar.  Experts understand the dozens of
scan techniques and choose the appropriate one (or combination) for a
given task.  Inexperienced users and script kiddies, on the other
hand, try to solve every problem with the default SYN scan.  Since Nmap is
free, the only barrier to port scanning mastery is knowledge.  That
certainly beats the automotive world, where it may take great skill to
determine that you need a strut spring compressor, then you still
have to pay thousands of dollars for it.</para>

<para>Most of the scan types are only available to privileged users.
This is because they send and receive raw packets, which requires root
access on UNIX systems.  Using an administrator account on Windows is
recommended, though Nmap sometimes works for unprivileged users on that
platform when WinPcap has already been loaded into the OS.  Requiring
root privileges was a serious limitation when Nmap was released in
1997, as many users only had access to shared shell accounts.  Now,
the world is different.  Computers are cheaper, far more people have
always-on direct Internet access, and desktop UNIX systems (including
Linux and MAC OS X) are prevalent.  A Windows version of Nmap is now
available, allowing it to run on even more desktops.  For all these
reasons, users have less need to run Nmap from limited shared shell accounts.
This is fortunate, as the privileged options make Nmap far more
powerful and flexible.</para>

<para>While Nmap attempts to produce accurate results, keep in mind
that all of its insights are based on packets returned by the target
machines (or firewalls in front of them).  Such hosts may be
untrustworthy and send responses intended to confuse or mislead Nmap.
Much more common are non-RFC-compliant hosts that do not respond as
they should to Nmap probes.  FIN, Null, and Xmas scans are
particularly susceptible to this problem.  Such issues are specific to
certain scan types and so are
discussed in the individual scan type entries.</para>

<para>This section documents the dozen or so port scan
techniques supported by Nmap.  Only one method may be used at a time,
except that UDP scan (<option>-sU</option>) may be combined with any
one of the TCP scan types.  As a memory aid, port scan type options
are of the form <option>-s<replaceable>C</replaceable></option>, where
<replaceable>C</replaceable> is a prominent character in the scan
name, usually the first.  The one exception to this is the deprecated
FTP bounce scan (<option>-b</option>).  By default, Nmap performs a
SYN Scan, though it substitutes a connect scan if the user does not
have proper privileges to send raw packets (requires root access on
UNIX) or if IPv6 targets were specified.  Of the scans listed in this
section, unprivileged users can only execute connect and ftp bounce
scans.</para>

    <variablelist>
      <varlistentry>
        <term>
        <option>-sS</option> (TCP SYN scan)</term>
        <listitem>

<indexterm significance="normal"><primary>-sS</primary></indexterm>
<indexterm significance="normal"><primary>SYN scan</primary></indexterm>
<para>SYN scan is the default and most popular scan option for good
reasons.  It can be performed quickly, scanning thousands of ports per
second on a fast network not hampered by intrusive firewalls. SYN scan
is relatively unobtrusive and stealthy, since it never completes TCP
connections.  It also works against any compliant TCP stack rather
than depending on idiosyncrasies of specific platforms as Nmap's
Fin/Null/Xmas, Maimon and Idle scans do.  It also allows clear,
reliable differentiation between the <literal moreinfo="none">open</literal>,
<literal moreinfo="none">closed</literal>, and <literal moreinfo="none">filtered</literal>
states.</para>

<para>This technique is often referred to as half-open scanning,
because you don't open a full TCP connection. You send a SYN packet,
as if you are going to open a real connection and then wait for a
response. A SYN/ACK indicates the port is listening (open), while a
RST (reset) is indicative of a non-listener. If no response is
received after several retransmissions, the port is marked as
filtered.  The port is also marked filtered if an ICMP unreachable
error (type 3, code 1,2, 3, 9, 10, or 13) is received.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sT</option> (TCP connect scan)</term>
        <listitem>
<indexterm significance="normal"><primary>-sT</primary></indexterm>
<indexterm significance="normal"><primary>connect() scan</primary></indexterm>
<para>TCP connect scan is the default TCP scan type when SYN scan is
not an option.  This is the case when a user does not have raw packet
privileges or is scanning IPv6 networks.  Instead of writing raw
packets as most other scan types do, Nmap asks the underlying
operating system to establish a connection with the target machine and
port by issuing the <literal moreinfo="none">connect()</literal> system call.  This is
the same high-level system call that web browsers, P2P clients, and
most other network-enabled applications use to establish a connection.
It is part of a programming interface known as the Berkeley Sockets
API.  Rather than read raw packet responses off the wire, Nmap uses
this API to obtain status information on each connection attempt.
</para>

<para>When SYN scan is available, it is usually a better choice.  Nmap
has less control over the high level <literal moreinfo="none">connect()</literal> call
than with raw packets, making it less efficient.  The system call
completes connections to open target ports rather than performing the
half-open reset that SYN scan does.  Not only does this take longer
and require more packets to obtain the same information, but target
machines are more likely to log the connection.  A decent IDS will
catch either, but most machines have no such alarm system.  Many
services on your average UNIX system will add a note to syslog, and
sometimes a cryptic error message, when Nmap connects and then closes
the connection without sending data.  Truly pathetic services crash
when this happens, though that is uncommon.  An administrator who sees
a bunch of connection attempts in her logs from a single system should
know that she has been connect scanned.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sU</option> (UDP scans)</term>
        <listitem>

<indexterm significance="normal"><primary>-sU</primary></indexterm>
<indexterm significance="normal"><primary>UDP scan</primary></indexterm>
<para>While most popular services on the Internet run over the TCP
protocol, <ulink url="http://www.rfc-editor.org/rfc/rfc768.txt">UDP</ulink> services
are widely deployed.  DNS, SNMP, and DHCP
(registered ports 53, 161/162, and 67/68) are three of the most
common.  Because UDP scanning is generally slower and more difficult
than TCP, some security auditors ignore these ports.  This is a mistake, as
exploitable UDP services are quite common and attackers certainly
don't ignore the whole protocol.  Fortunately, Nmap can help inventory
UDP ports.</para>

<para>UDP scan is activated with the <option>-sU</option> option.  It
can be combined with a TCP scan type such as SYN scan
(<option>-sS</option>) to check both protocols during the same
run.</para>

<para>UDP scan works by sending an empty (no data) UDP header to every
targeted port.  If an ICMP port unreachable error (type 3, code 3) is
returned, the port is <literal moreinfo="none">closed</literal>.  Other ICMP unreachable errors (type 3,
codes 1, 2, 9, 10, or 13) mark the port as <literal moreinfo="none">filtered</literal>.  Occasionally, a
service will respond with a UDP packet, proving that it is <literal moreinfo="none">open</literal>.  If
no response is received after retransmissions, the port is classified
as <literal moreinfo="none">open|filtered</literal>.  This means that the port could be open, or perhaps
packet filters are blocking the communication. Versions scan
(<option>-sV</option>) can be used to help differentiate the truly
open ports from the filtered ones.</para>

<para>A big challenge with UDP scanning is doing it quickly.
Open and filtered ports rarely send any response, leaving Nmap to time
out and then conduct retransmissions just in case the probe or
response were lost.  Closed ports are often an even bigger problem.
They usually send back an ICMP port unreachable error.  But unlike the
RST packets sent by closed TCP ports in response to a SYN or connect
scan, many hosts rate limit ICMP port unreachable messages by default.
Linux and Solaris are particularly strict about this.  For example, the
Linux 2.4.20 kernel limits destination unreachable messages to one per
second (in <filename moreinfo="none">net/ipv4/icmp.c</filename>).</para>

<para>Nmap detects rate limiting and slows down accordingly to avoid
flooding the network with useless packets that the target machine will
drop.  Unfortunately, a Linux-style limit of one packet per second
makes a 65,536-port scan take more than 18 hours.  Ideas for speeding
your UDP scans up include scanning more hosts in parallel, doing a
quick scan of just the popular ports first, scanning from behind the
firewall, and using <option>--host-timeout</option> to skip slow
hosts.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sN</option>; <option>-sF</option>; <option>-sX</option> (TCP Null, FIN, and Xmas scans)</term>
        <listitem>

<indexterm significance="normal"><primary>-sN</primary></indexterm>
<indexterm significance="normal"><primary>-sF</primary></indexterm>
<indexterm significance="normal"><primary>-sX</primary></indexterm>
<indexterm significance="normal"><primary>NULL scan</primary></indexterm>
<indexterm significance="normal"><primary>FIN scan</primary></indexterm>
<indexterm significance="normal"><primary>Xmas scan</primary></indexterm>
<para>These three scan types (even more are possible with the
<option>--scanflags</option> option described in the next section)
exploit a subtle loophole in the <ulink url="http://www.rfc-editor.org/rfc/rfc793.txt">TCP RFC</ulink> to
differentiate between <literal moreinfo="none">open</literal> and
<literal moreinfo="none">closed</literal> ports.  Page 65 says that <quote>if the
[destination] port state is CLOSED .... an incoming segment not
containing a RST causes a RST to be sent in response.</quote>  Then the next
page discusses packets sent to open ports without the SYN, RST, or ACK
bits set, stating that: <quote>you are unlikely to get here, but if you do, drop the
segment, and return.</quote></para>

<para>When scanning systems compliant with this RFC text, any packet
not containing SYN, RST, or ACK bits will result in a returned RST if
the port is closed and no response at all if the port is open.  As
long as none of those three bits are included, any combination of the
other three (FIN, PSH, and URG) are OK.  Nmap exploits this with three
scan types:</para>

<variablelist>
  <varlistentry><term>Null scan (<option>-sN</option>)</term>
  <listitem><para>Does not set any bits (tcp flag header is 0)</para></listitem></varlistentry> 

  <varlistentry><term>FIN scan (<option>-sF</option>)</term>
  <listitem><para>Sets just the TCP FIN bit.</para></listitem></varlistentry> 

  <varlistentry><term>Xmas scan (<option>-sX</option>)</term>
  <listitem><para>Sets the FIN, PSH, and URG flags, lighting the
  packet up like a Christmas tree.</para></listitem></varlistentry>
</variablelist>

<para>These three scan types are exactly the same in behavior except
for the TCP flags set in probe packets.  If a RST packet is received,
the port is considered <literal moreinfo="none">closed</literal>, while no response
means it is <literal moreinfo="none">open|filtered</literal>.  The port is marked
<literal moreinfo="none">filtered</literal> if an ICMP unreachable error (type 3, code
1, 2, 3, 9, 10, or 13) is received.</para>

<para>The key advantage to these scan types is that they can sneak
through certain non-stateful firewalls and packet filtering
routers. Another advantage is that these scan types are a little more
stealthy than even a SYN scan.  Don't count on this though -- most
modern IDS products can be configured to detect them.  The big
downside is that not all systems follow RFC 793 to the letter.  A
number of systems send RST responses to the probes regardless of
whether the port is open or not.  This causes all of the ports to be
labeled <literal moreinfo="none">closed</literal>.  Major operating systems that do
this are Microsoft Windows, many Cisco devices, BSDI, and IBM OS/400.
This scan does work against most UNIX-based systems though. Another
downside of these scans is that they can't distinguish <literal moreinfo="none">open</literal> ports from
certain <literal moreinfo="none">filtered</literal> ones, leaving you with the response
<literal moreinfo="none">open|filtered</literal>.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sA</option> (TCP ACK scan)</term>
        <listitem>

<indexterm significance="normal"><primary>-sA</primary></indexterm>
<indexterm significance="normal"><primary>ACK scan</primary></indexterm>
<para>This scan is different than the others discussed so far in that
it never determines <literal moreinfo="none">open</literal> (or even
<literal moreinfo="none">open|filtered</literal>) ports.  It is used to map out
firewall rulesets, determining whether they are stateful or not and
which ports are filtered.</para>

<para>The ACK scan probe packet has only the ACK flag set (unless you
use <option>--scanflags</option>).  When scanning unfiltered systems,
<literal moreinfo="none">open</literal> and <literal moreinfo="none">closed</literal> ports will both
return a RST packet.  Nmap then labels them as
<literal moreinfo="none">unfiltered</literal>, meaning that they are reachable by the
ACK packet, but whether they are <literal moreinfo="none">open</literal> or
<literal moreinfo="none">closed</literal> is undetermined.  Ports that don't respond,
or send certain ICMP error messages back (type 3, code 1, 2, 3, 9, 10,
or 13), are labeled <literal moreinfo="none">filtered</literal>.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sW</option> (TCP Window scan)</term>
        <listitem>

<indexterm significance="normal"><primary>-sW</primary></indexterm>
<indexterm significance="normal"><primary>Window scan</primary></indexterm>
<para>Window scan is exactly the same as ACK scan except that it
exploits an implementation detail of certain systems to differentiate
open ports from closed ones, rather than always printing
<literal moreinfo="none">unfiltered</literal> when a RST is returned.  It does this by
examining the TCP Window field of the RST packets returned.  On some
systems, open ports use a positive window size (even for RST packets)
while closed ones have a zero window.  So instead of always listing a
port as <literal moreinfo="none">unfiltered</literal> when it receives a RST back,
Window scan lists the port as <literal moreinfo="none">open</literal> or
<literal moreinfo="none">closed</literal> if the TCP Window value in that reset is
positive or zero, respectively.</para>

<para>This scan relies on an implementation detail of a minority of
systems out on the Internet, so you can't always trust it.  Systems
that don't support it will usually return all ports
<literal moreinfo="none">closed</literal>.  Of course, it is possible that the machine
really has no open ports.  If most scanned ports are
<literal moreinfo="none">closed</literal> but a few common port numbers (such as 22,
25, 53) are <literal moreinfo="none">filtered</literal>, the system is most likely
susceptible.  Occasionally, systems will even show the exact opposite
behavior.  If your scan shows 1000 open ports and 3 closed or filtered
ports, then those three may very well be the truly open ones.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sM</option> (TCP Maimon scan)</term>
        <listitem>

<indexterm significance="normal"><primary>-sM</primary></indexterm>
<indexterm significance="normal"><primary>Maimon scan</primary></indexterm>
<para>The Maimon scan is named after its discoverer, Uriel Maimon.  He
described the technique in Phrack Magazine issue #49 (November 1996).
Nmap, which included this technique, was released two issues later.
This technique is exactly the same as Null, FIN, and Xmas scans, except
that the probe is FIN/ACK.  According to RFC 793 (TCP), a RST packet
should be generated in response to such a probe whether the port is
open or closed.  However, Uriel noticed that many BSD-derived systems
simply drop the packet if the port is open.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>--scanflags</option> (Custom TCP scan)</term>
        <listitem>

<indexterm significance="normal"><primary>--scanflags</primary></indexterm>
<para>Truly advanced Nmap users need not limit themselves to the
canned scan types offered.  The <option>--scanflags</option> option allows
you to design your own scan by specifying arbitrary TCP flags.  Let
your creative juices flow, while evading intrusion detection systems whose vendors simply paged through the Nmap man page adding specific rules!</para>

<para>The <option>--scanflags</option> argument can be a numerical
flag value such as 9 (PSH and FIN), but using symbolic names is
easier.  Just mash together any combination of  <literal moreinfo="none">URG</literal>,
<literal moreinfo="none">ACK</literal>, <literal moreinfo="none">PSH</literal>,
<literal moreinfo="none">RST</literal>, <literal moreinfo="none">SYN</literal>, and
<literal moreinfo="none">FIN</literal>.  For example, <option>--scanflags
URGACKPSHRSTSYNFIN</option> sets everything, though it's not very
useful for scanning.  The order these are specified in is
irrelevant.</para>

<para>In addition to specifying the desired flags, you can specify a
TCP scan type (such as <option>-sA</option> or <option>-sF</option>).
That base type tells Nmap how to interpret responses.  For
example, a SYN scan considers no-response to indicate a
<literal moreinfo="none">filtered</literal> port, while a FIN scan treats the same as
<literal moreinfo="none">open|filtered</literal>.  Nmap will behave the same way it
does for the base scan type, except that it will use the TCP flags you
specify instead.  If you don't specify a base type, SYN scan is
used.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sI &lt;zombie
        host[:probeport]&gt;</option> (Idlescan)</term>

        <listitem>

          <indexterm significance="normal"><primary>-sI</primary></indexterm>
          <indexterm significance="normal"><primary>Idle scan</primary></indexterm>
          <para>This advanced scan method allows for a truly blind TCP
          port scan of the target (meaning no packets are sent to the
          target from your real IP address). Instead, a unique
          side-channel attack exploits predictable IP fragmentation ID
          sequence generation on the zombie host to glean information
          about the open ports on the target.  IDS systems will
          display the scan as coming from the zombie machine you
          specify (which must be up and meet certain criteria). This
          fascinating scan type is too complex to fully describe in this reference
          guide, so I wrote and posted an informal paper with full details at
          <ulink url="http://www.insecure.org/nmap/idlescan.html"/>.</para>

          <para>Besides being extraordinarily stealthy (due to its
          blind nature), this scan type permits mapping out
          IP-based trust relationships between machines. The port
          listing shows open ports 
          <emphasis>from the perspective of the zombie
          host.</emphasis> So you can try scanning a target using
          various zombies that you think might be trusted (via
          router/packet filter rules).</para>

          <para>You can add a colon followed by a port number to the
          zombie host if you wish to probe a particular port on the
          zombie for IPID changes. Otherwise Nmap will use the port it
          uses by default for tcp pings (80).</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sO</option> (IP protocol scan)</term>
        <listitem>
          
        <indexterm significance="normal"><primary>-sO</primary></indexterm>
        <indexterm significance="normal"><primary>Protocol scan</primary></indexterm>
<para>IP Protocol scan allows you to determine which IP protocols
(TCP, ICMP, IGMP, etc.) are supported by target machines.  This isn't
technically a port scan, since it cycles through IP protocol numbers
rather than TCP or UDP port numbers. Yet it still uses the
<option>-p</option> option to select scanned protocol numbers, reports
its results within the normal port table format, and even uses the same
underlying scan engine as the true port scanning methods. So it is
close enough to a port scan that it belongs here.</para>

<para>Besides being useful in its own right, protocol scan
demonstrates the power of open source software.  While the fundamental
idea is pretty simple, I had not thought to add it nor received any
requests for such functionality.  Then in the summer of 2000, Gerhard
Rieger conceived the idea, wrote an excellent patch implementing it,
and sent it to the nmap-hackers mailing list.  I incorporated that
patch into the Nmap tree and released a new version the next day.  Few
pieces of commercial software have users enthusiastic enough to design
and contribute their own improvements!</para>

<para>Protocol scan works in a similar fashion to UDP scan.  Instead
of iterating through the port number field of a UDP packet, it sends
IP packet headers and iterates through the 8-bit IP protocol field.
The headers are usually empty, containing no data and not even the
proper header for the claimed protocol.  The three exceptions are TCP,
UDP, and ICMP.  A proper protocol header for those is included since
some systems won't send them otherwise and because Nmap already has
functions to create them.  Instead of watching for ICMP port
unreachable messages, protocol scan is on the lookout for ICMP
<emphasis>protocol</emphasis> unreachable messages.  If Nmap receives
any response in any protocol from the target host, Nmap marks that
protocol as <literal moreinfo="none">open</literal>.  An ICMP protocol unreachable
error (type 3, code 2) causes the protocol to be marked as
<literal moreinfo="none">closed</literal> Other ICMP unreachable errors (type 3, code
1, 3, 9, 10, or 13) cause the protocol to be marked
<literal moreinfo="none">filtered</literal> (though they prove that ICMP is
<literal moreinfo="none">open</literal> at the same time).  If no response is received
after retransmissions, the protocol is marked
<literal moreinfo="none">open|filtered</literal></para>

        </listitem>
      </varlistentry>



      <varlistentry>
        <term>
        <option>-b &lt;ftp relay host&gt;</option> (FTP bounce scan)</term>
        <listitem>

        <indexterm significance="normal"><primary>-b</primary></indexterm>
        <indexterm significance="normal"><primary>FTP bounce scan</primary></indexterm>
<para>An interesting feature of the FTP protocol (<ulink url="http://www.rfc-editor.org/rfc/rfc959.txt">RFC 959</ulink>) is
support for so-called proxy ftp connections.  This allows a user to
connect to one FTP server, then ask that files be sent to a
third-party server.  Such a feature is ripe for abuse on many levels,
so most servers have ceased supporting it.  One of the abuses this
feature allows is causing the FTP server to port scan other hosts.
Simply ask the FTP server to send a file to each interesting port of a
target host in turn.  The error message will describe whether the port
is open or not.  This is a good way to bypass firewalls because
organizational FTP servers are often placed where they have
more access to other internal hosts than any old Internet host would.  Nmap supports ftp
bounce scan with the <option>-b</option> option.  It takes an argument
of the form
<replaceable>username</replaceable>:<replaceable>password</replaceable>@<replaceable>server</replaceable>:<replaceable>port</replaceable>.
<replaceable>Server</replaceable> is the name or IP address of a
vulnerable FTP server.  As with a normal URL, you may omit
<replaceable>username</replaceable>:<replaceable>password</replaceable>,
in which case anonymous login credentials (user:
<literal moreinfo="none">anonymous</literal> password:<literal moreinfo="none">-wwwuser@</literal>)
are used.  The port number (and preceding colon) may be omitted as
well, in which case the default FTP port (21) on
<replaceable>server</replaceable> is used.</para>

<para>This vulnerability was widespread in 1997 when Nmap was
released, but has largely been fixed.  Vulnerable servers are still
around, so it is worth trying when all else fails.  If bypassing a
firewall is your goal, scan the target network for open port 21 (or
even for any ftp services if you scan all ports with version
detection), then try a bounce scan using each.  Nmap will tell you
whether the host is vulnerable or not.  If you are just trying to
cover your tracks, you don't need to (and, in fact, shouldn't) limit
yourself to hosts on the target network.  Before you go scanning
random Internet addresses for vulnerable FTP servers, consider that
sysadmins may not appreciate you abusing their servers in this
way.</para>

        </listitem>
      </varlistentry>
    </variablelist>
   </refsect1>

   <refsect1 id="man-port-specification">
    <title>Port Specification and Scan Order</title>

    <para>In addition to all of the scan methods discussed previously,
    Nmap offers options for specifying which ports are scanned and
    whether the scan order is randomized or sequential.  By default, Nmap scans all ports up to and including 1024 as well as higher numbered ports listed in the <filename moreinfo="none">nmap-services</filename> file for the protocol(s) being scanned.</para>

    <variablelist>
      <varlistentry>
        <term>
          <option>-p &lt;port ranges&gt;</option> (Only scan specified ports)
        </term>
        <listitem>

          <indexterm significance="normal"><primary>-p</primary></indexterm>
          <para>This option specifies which ports you want to scan and
          overrides the default.  Individual port numbers are OK, as
          are ranges separated by a hyphen (e.g. 1-1023).  The
          beginning and/or end values of a range may be omitted,
          causing Nmap to use 1 and 65535, respectively.  So you can
          specify <option>-p-</option> to scan ports from 1 through
          65535.  Scanning port zero is allowed if you specify it
          explicitly. For IP protocol scanning (<option>-sO</option>), this option
          specifies the protocol numbers you wish to scan for
          (0-255).</para>

          <para>When scanning both TCP and UDP ports, you can specify
          a particular protocol by preceding the port numbers by <literal moreinfo="none">T:</literal>
          or <literal moreinfo="none">U:</literal>. The qualifier lasts until you specify another
          qualifier. For example, the argument <option>-p
          U:53,111,137,T:21-25,80,139,8080</option> would scan UDP
          ports 53,111,and 137, as well as the listed TCP ports. Note
          that to scan both UDP &amp; TCP, you have to specify
          <option>-sU</option> and at least one TCP scan type (such as
          <option>-sS</option>, <option>-sF</option>, or
          <option>-sT</option>). If no protocol qualifier is given,
          the port numbers are added to all protocol lists.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-F</option> (Fast (limited port) scan)
        </term>
        <listitem>

          <indexterm significance="normal"><primary>-F</primary></indexterm>
          <para>Specifies that you only wish to scan
          for ports listed in the <filename moreinfo="none">nmap-services</filename>
          file which comes with nmap (or the protocols file for
          <option>-sO</option>). This is much faster than scanning all 65535 ports on a
          host.  Because this list contains so many TCP ports (more
          than 1200), the speed difference from a default TCP scan
          (about 1650 ports) isn't dramatic.  The difference can be
          enormous if you specify your own tiny
          <filename moreinfo="none">nmap-services</filename> file using the
          <option>--datadir</option> option.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-r</option> (Don't randomize ports)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-r</primary></indexterm>
          <para>By default, Nmap randomizes the scanned port order
          (except that certain commonly accessible ports are moved
          near the beginning for efficiency reasons).  This
          randomization is normally desirable, but you can specify
          <option>-r</option> for sequential port scanning
          instead.</para>
        </listitem>
      </varlistentry>
    </variablelist>
   </refsect1>

  <refsect1 id="man-version-detection">
    <title>Service and Version Detection</title>

    <indexterm significance="normal"><primary>version scan</primary></indexterm>
    <para>Point Nmap at a remote machine and it might tell you
    that ports 25/tcp, 80/tcp, and 53/udp are open. Using its
    <filename moreinfo="none">nmap-services</filename> database of about 2,200 well-known services,
    Nmap would report that those ports probably correspond to a
    mail server (SMTP), web server (HTTP), and name server (DNS)
    respectively. This lookup is usually accurate -- the vast
    majority of daemons listening on TCP port 25 are, in fact, mail
    servers. However, you should not bet your security on this!
    People can and do run services on strange ports.</para>

    <para>Even if Nmap is right, and the hypothetical server above is
    running SMTP, HTTP, and DNS servers, that is not a lot of
    information. When doing vulnerability assessments (or even simple
    network inventories) of your companies or clients, you really want
    to know which mail and DNS servers and versions are
    running. Having an accurate version number helps dramatically in
    determining which exploits a server is vulnerable to.  Version
    detection helps you obtain this information.
</para>

    <para>After TCP and/or UDP ports are discovered using one of the
    other scan methods, version detection interrogates those ports to
    determine more about what is actually running. The
    <filename moreinfo="none">nmap-service-probes</filename> database contains probes
    for querying various services and match expressions to recognize
    and parse responses. Nmap tries to determine the service protocol
    (e.g. ftp, ssh, telnet, http), the application name (e.g. ISC
    Bind, Apache httpd, Solaris telnetd), the version number,
    hostname, device type (e.g. printer, router), the OS family
    (e.g. Windows, Linux) and sometimes miscellaneous details like
    whether an X server is open to connections, the SSH protocol
    version, or the KaZaA user name).  Of course, most services don't
    provide all of this information.  If Nmap was compiled with
    OpenSSL support, it will connect to SSL servers to deduce the
    service listening behind that encryption layer. When RPC services are
    discovered, the Nmap RPC grinder (<option>-sR</option>) is
    automatically used to determine the RPC program and version
    numbers. Some UDP ports are left in the
    <literal moreinfo="none">open|filtered</literal> state after a UDP port scan is
    unable to determine whether the port is open or filtered. Version
    detection will try to elicit a response from these ports (just as
    it does with open ports), and change the state to open if it
    succeeds. <literal moreinfo="none">open|filtered</literal> TCP ports are treated
    the same way.  Note that the Nmap <option>-A</option> option
    enables version detection among other things.  A paper documenting
    the workings, usage, and customization of version detection is
    available at <ulink url="http://www.insecure.org/nmap/vscan/"/>.</para>

    <para>When Nmap receives responses from a service but cannot match
    them to its database, it prints out a special fingerprint and
    a URL for you to submit if to if you know for sure what is running
    on the port.  Please take a couple minutes to make the submission
    so that your find can benefit everyone.  Thanks to these
    submissions, Nmap has about 3,000 pattern matches for more than
    350 protocols such as smtp, ftp, http, etc.</para>

    <para>Version detection is enabled and controlled with the
    following options:</para>


    <variablelist>

      <varlistentry>
        <term>
        <option>-sV</option> (Version detection)</term>
        <listitem>

          <indexterm significance="normal"><primary>-sV</primary></indexterm>
          <para>Enables version detection, as discussed above.
          Alternatively, you can use <option>-A</option> to enable
          both OS detection and version detection.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--allports</option> (Don't exclude any ports from
          version detection)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--allports</primary></indexterm>
          <para>By default, Nmap version detection skips TCP port 9100
          because some printers simply print anything sent to that
          port, leading to dozens of pages of HTTP get requests, binary
          SSL session requests, etc.  This behavior can be changed by
          modifying or removing the <literal moreinfo="none">Exclude</literal>
          directive in <filename moreinfo="none">nmap-service-probes</filename>, or
          you can specify <option>--allports</option> to scan all
          ports regardless of any <literal moreinfo="none">Exclude</literal>
          directive.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--version-intensity &lt;intensity&gt;</option> (Set
          version scan intensity)
        </term>
        <listitem>

          <indexterm significance="normal"><primary>--version-intensity</primary></indexterm>
          <para>When performing a version scan (<option>-sV</option>), nmap sends a
          series of probes, each of which is assigned a rarity value
          between 1 and 9. The lower-numbered probes are effective
          against a wide variety of common services, while the higher
          numbered ones are rarely useful. The intensity level
          specifies which probes should be applied. The higher the
          number, the more likely it is the service will be correctly
          identified. However, high intensity scans take longer.  The
          intensity must be between 0 and 9. The default is 7.  When a
          probe is registered to the target port via the
          <filename moreinfo="none">nmap-service-probes</filename> <literal moreinfo="none">ports</literal> directive, that probe is tried
          regardless of intensity level.  This ensures that the DNS
          probes will always be attempted against any open port 53,
          the SSL probe will be done against 443, etc.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--version-light</option> (Enable light mode)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--version-light</primary></indexterm>
          <para>This is a convenience alias for
          <option>--version-intensity 2</option>.  This light mode
          makes version scanning much faster, but it is slightly less
          likely to identify services.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--version-all</option> (Try every single probe)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--version-all</primary></indexterm>
          <para>An alias for <option>--version-intensity 9</option>,
          ensuring that every single probe is attempted against each
          port.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--version-trace</option> (Trace version scan activity)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--version-trace</primary></indexterm>
          <para>This causes Nmap to print out extensive debugging info
          about what version scanning is doing.  It is a subset of
          what you get with <option>--packet-trace</option>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-sR</option> (RPC scan)</term>
        <listitem>
          <indexterm significance="normal"><primary>--sR</primary></indexterm>
          <para>This method works in conjunction with the various port
          scan methods of Nmap. It takes all the TCP/UDP ports found
          open and floods them with SunRPC program NULL commands in an
          attempt to determine whether they are RPC ports, and if so,
          what program and version number they serve up. Thus you can
          effectively obtain the same info as <command moreinfo="none">rpcinfo -p</command> even if the
          target's portmapper is behind a firewall (or protected by
          TCP wrappers). Decoys do not currently work with RPC scan.
          This is automatically enabled as part of version scan
          (<option>-sV</option>) if you request that.  As version
          detection includes this and is much more comprehensive,
          <option>-sR</option> is rarely needed.</para>
        </listitem>
      </varlistentry>
  
    </variablelist>
  </refsect1>

  <refsect1 id="man-os-detection">

    <title>OS Detection</title>

    <indexterm significance="normal"><primary>OS detection</primary></indexterm>
    <para>One of Nmap's best-known features is remote OS detection
    using TCP/IP stack fingerprinting.  Nmap sends a series of TCP and
    UDP packets to the remote host and examines practically every bit
    in the responses.  After performing dozens of tests such as TCP
    ISN sampling, TCP options support and ordering, IPID sampling, and
    the initial window size check, Nmap compares the results to its
    <filename moreinfo="none">nmap-os-fingerprints</filename> database of more than 1500 known
    OS fingerprints and prints out the OS details if there is a match.
    Each fingerprint includes a freeform textual description of the
    OS, and a classification which provides the vendor name
    (e.g. Sun), underlying OS (e.g. Solaris), OS generation (e.g. 10),
    and device type (general purpose, router, switch, game console,
    etc).</para>

    <para>If Nmap is unable to guess the OS of a machine, and
    conditions are good (e.g. at least one open port and one closed
    port were found), Nmap will
    provide a URL you can use to submit the fingerprint if you know
    (for sure) the OS running on the machine.  By doing this you
    contribute to the pool of operating systems known to Nmap and thus
    it will be more accurate for everyone.</para>

    <para>OS detection enables several other tests which make use
    of information that is gathered during the process anyway.  One of these
    is uptime measurement, which uses the TCP timestamp option (RFC
    1323) to guess when a machine was last rebooted.  This is only
    reported for machines which provide this information.  Another is
    TCP Sequence Predictability Classification.  This measures
    approximately how hard it is to establish a forged
    TCP connection against the remote host.  It is useful for
    exploiting source-IP based trust relationships (rlogin, firewall
    filters, etc) or for hiding the source of an attack.  This sort of
    spoofing is rarely performed any more, but many machines are still
    vulnerable to it.  The actual
    difficulty number is based on statistical sampling and may
    fluctuate.  It is generally better to use the English
    classification such as <quote>worthy challenge</quote> or <quote>trivial joke</quote>.  This
    is only reported in normal output in verbose (<option>-v</option>)
    mode.  When verbose mode is enabled along with <option>-O</option>, IPID Sequence
    Generation is also reported.  Most machines are in the
    <quote>incremental</quote> class, which means that they increment the ID
    field in the IP header for each packet they send.  This makes them
    vulnerable to several advanced information gathering and
    spoofing attacks.</para>

    <para>A paper documenting the workings, usage, and customization
    of version detection is available in more than a dozen languages at <ulink url="http://www.insecure.org/nmap/nmap-fingerprinting-article.html"/>.</para>

    <para>OS detection is enabled and controlled with the following options:</para>

    <variablelist>
      <varlistentry>
        <term>
          <option>-O</option> (Enable OS detection)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-O</primary></indexterm>
          <para>Enables OS detection, as discussed above.
          Alternatively, you can use <option>-A</option> to enable
          both OS detection and version detection.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--osscan-limit</option> (Limit OS detection to
          promising targets)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--osscan-limit</primary></indexterm>
          <para>OS detection is far more effective if at least one
          open and one closed TCP port are found. Set this option
          and Nmap will not even try OS detection against hosts
          that do not meet this criteria. This can save substantial
          time, particularly on <option>-P0</option> scans against many hosts. It
          only matters when OS detection is requested with <option>-O</option> or <option>-A</option>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--osscan-guess</option>; <option>--fuzzy</option> (Guess OS detection results)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--osscan-guess</primary></indexterm>
          <para>When Nmap is unable to detect a perfect OS match, it
          sometimes offers up near-matches as possibilities.  The
          match has to be very close for Nmap to do this by default.
          Either of these (equivalent) options make Nmap guess more
          aggressively.  Nmap will still tell you when an imperfect
          match is printed and display its confidence level
          (percentage) for each guess.</para>
        </listitem>
      </varlistentry>


    </variablelist>
  </refsect1>

   <refsect1 id="man-performance">
    <title>Timing and Performance</title>
    <para>One of my highest Nmap development priorities has always been
performance.  A default scan (<command moreinfo="none">nmap
<replaceable>hostname</replaceable></command>) of a host on my local
network takes a fifth of a second.  That is barely enough time to
blink, but adds up when you are scanning tens or hundreds of thousands
of hosts.  Moreover, certain scan options such as UDP scanning and
version detection can increase scan times substantially.  So can
certain firewall configurations, particularly response rate limiting.
While Nmap utilizes parallelism and many advanced algorithms to
accelerate these scans, the user has ultimate control over how Nmap
runs.  Expert users carefully craft Nmap commands to obtain only the
information they care about while meeting their time
constraints.</para>

    <para>Techniques for improving scan times include omitting
    non-critical tests, and upgrading to the latest version of Nmap
    (performance enhancements are made frequently).  Optimizing timing
    parameters can also make a substantial difference.  Those options
    are listed below.</para>

<para>Some options accept a <literal moreinfo="none">time</literal> parameter.  This
is specified in milliseconds by default, though you can append ‘s’, ‘m’,
or ‘h’ to the value to specify seconds, minutes, or hours. So the
<option>--host-timeout</option> arguments <literal moreinfo="none">900000</literal>,
<literal moreinfo="none">900s</literal>, and <literal moreinfo="none">15m</literal> all do the same thing.</para>

    <variablelist>

      <varlistentry>
        <term>
        <option>--min-hostgroup &lt;numhosts&gt;</option>; 
        <option>--max-hostgroup
        &lt;numhosts&gt;</option> (Adjust parallel scan group sizes)</term>
        <listitem>
<indexterm significance="normal"><primary>--min-hostgroup</primary></indexterm>
<indexterm significance="normal"><primary>--max-hostgroup</primary></indexterm>
<para>Nmap has the ability to port scan or version scan multiple hosts
in parallel.  Nmap does this by dividing the target IP space into
groups and then scanning one group at a time.  In general, larger
groups are more efficient.  The downside is that host results can't be
provided until the whole group is finished.  So if Nmap started out
with a group size of 50, the user would not receive any reports
(except for the updates offered in verbose mode) until the first 50
hosts are completed.</para>

<para>By default, Nmap takes a compromise approach to this conflict.
It starts out with a group size as low as five so the first results
come quickly and then increases the groupsize to as high as 1024.  The
exact default numbers depend on the options given.  For efficiency
reasons, Nmap uses larger group sizes for UDP or few-port TCP
scans.</para>

<para>When a maximum group size is specified with
<option>--max-hostgroup</option>, Nmap will never exceed that size.
Specify a minimum size with <option>--min-hostgroup</option> and Nmap
will try to keep group sizes above that level.  Nmap may have to use
smaller groups than you specify if there are not enough target hosts
left on a given interface to fulfill the specified minimum.  Both may
be set to keep the group size within a specific range, though this is
rarely desired.</para>

<para>The primary use of these options is to specify a large minimum
group size so that the full scan runs more quickly.  A common choice
is 256 to scan a network in Class C sized chunks.  For a scan with
many ports, exceeding that number is unlikely to help much. For scans
of just a few port numbers, host group sizes of 2048 or more may be
helpful.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>--min-parallelism &lt;numprobes&gt;</option>;
        <option>--max-parallelism
        &lt;numprobes&gt;</option> (Adjust probe parallelization)</term>
        <listitem>

<indexterm significance="normal"><primary>--min-parallelism</primary></indexterm>
<indexterm significance="normal"><primary>--max-parallelism</primary></indexterm>
<para>These options control the total number of probes that may
be outstanding for a host group.  They are used for port scanning and
host discovery.  By default, Nmap calculates an ever-changing ideal
parallelism based on network performance.  If packets are being dropped,
Nmap slows down and allows fewer outstanding probes.  The ideal probe
number slowly rises as the network proves itself worthy.  These
options place minimum or maximum bounds on that variable.  By default,
the ideal parallelism can drop to 1 if the network proves unreliable
and rise to several hundred in perfect conditions.</para>

<para>The most common usage is to set
<option>--min-parallelism</option> to a number higher than one to
speed up scans of poorly performing hosts or networks.  This is a
risky option to play with, as setting it too high may affect accuracy.
Setting this also reduces Nmap's ability to control parallelism
dynamically based on network conditions.  A value of ten might be
reasonable, though I only adjust this value as a last resort.</para>

<para>The <option>--max-parallelism</option> option is sometimes set to one
to prevent Nmap from sending more than one probe at a time to hosts.
This can be useful in combination with <option>--scan-delay</option>
(discussed later), although the latter usually serves the purpose well
enough by itself.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>--min-rtt-timeout &lt;time&gt;</option>, 
        <option>--max-rtt-timeout &lt;time&gt;</option>, 
        <option>--initial-rtt-timeout
        &lt;time&gt;</option> (Adjust probe timeouts)</term>
        <listitem>

<indexterm significance="normal"><primary>--min-rtt-timeout</primary></indexterm>
<indexterm significance="normal"><primary>--max-rtt-timeout</primary></indexterm>
<indexterm significance="normal"><primary>--initial-rtt-timeout</primary></indexterm>
<para>Nmap maintains a
running timeout value for determining how long it will wait for a
probe response before giving up or retransmitting the probe.  This is
calculated based on the response times of previous probes.  If
the network latency shows itself to be significant and variable, this
timeout can grow to several seconds.  It also starts at a conservative
(high) level and may stay that way for a while when Nmap scans
unresponsive hosts.</para>

<para>
Specifying a lower <option>--max-rtt-timeout</option> and
<option>--initial-rtt-timeout</option> than the defaults can cut scan
times significantly.  This is particularly true for pingless
(<option>-P0</option>) scans, and those against heavily filtered
networks.  Don't get too aggressive though.  The scan can end up
taking longer if you specify such a low value that many probes are
timing out and retransmitting while the response is in transit.</para>

<para>If all the hosts are on a local network, 100 milliseconds is a
reasonable aggressive <option>--max-rtt-timeout</option> value.  If
routing is involved, ping a host on the network first with the ICMP
ping utility, or with a custom packet crafter such as hping2 that is
more likely to get through a firewall.  Look at the maximum round trip
time out of ten packets or so.  You might want to double that for the
<option>--initial-rtt-timeout</option> and triple or quadruple it for
the <option>--max-rtt-timeout</option>.  I generally do not set the
maximum rtt below 100ms, no matter what the ping times are.  Nor do I
exceed 1000ms.</para>

<para><option>--min-rtt-timeout</option> is a rarely used option that
could be useful when a network is so unreliable that even Nmap's
default is too aggressive.  Since Nmap only reduces the timeout down to
the minimum when the network seems to be reliable, this need is
unusual and should be reported as a bug to the nmap-dev mailing
list.</para>

        </listitem>
      </varlistentry>


      <varlistentry>
        <term>
          <option>--max-retries &lt;numtries&gt;</option> (Specify the
          maximum number of port scan probe retransmissions)
        </term>
        <listitem>

<indexterm significance="normal"><primary>--max-retries</primary></indexterm>
<para>When Nmap receives no response to a port scan probe, it could
mean the port is filtered.  Or maybe the probe or response was simply
lost on the network.  It is also possible that the target host has
rate limiting enabled that temporarily blocked the response.  So Nmap
tries again by retransmitting the initial probe.  If Nmap detects poor
network reliability, it may try many more times before giving up on a
port.  While this benefits accuracy, it also lengthen scan times.
When performance is critical, scans may be sped up by limiting the
number of retransmissions allowed.  You can even specify
<option>--max-retries 0</option> to prevent any retransmissions,
though that is rarely recommended.
</para>

<para>The default (with no <option>-T</option> template) is to allow
ten retransmissions.  If a network seems reliable and the target hosts
aren't rate limiting, Nmap usually only does one retransmission.  So
most target scans aren't even affected by dropping
<option>--max-retries</option> to a low value such as three.  Such
values can substantially speed scans of slow (rate limited) hosts.
You usually lose some information when Nmap gives up on ports early,
though that may be preferable to letting the
<option>--host-timeout</option> expire and losing all information
about the target.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--host-timeout &lt;time&gt;</option> (Give
          up on slow target hosts)
        </term>
        <listitem>

<indexterm significance="normal"><primary>--host-timeout</primary></indexterm>
<para>Some hosts simply take a <emphasis>long</emphasis> time to scan.
This may be due to poorly performing or unreliable networking hardware
or software, packet rate limiting, or a restrictive firewall.  The
slowest few percent of the scanned hosts can eat up a majority of the
scan time.  Sometimes it is best to cut your losses and skip those
hosts initially.  Specify 
<option>--host-timeout</option> with the maximum amoung of time you
are willing to wait.  I
often specify <literal moreinfo="none">30m</literal> to ensure that Nmap doesn't waste
more than half an hour on a single host.  Note that Nmap may be
scanning other hosts at the same time during that half an hour as
well, so it isn't a complete loss.  A host that times out is skipped.
No port table, OS detection, or version detection results are printed
for that host.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>--scan-delay &lt;time&gt;</option>;
        <option>--max-scan-delay
        &lt;time&gt;</option> (Adjust delay between probes)</term>
        <listitem>

<indexterm significance="normal"><primary>--scan-delay</primary></indexterm>
<indexterm significance="normal"><primary>--max-scan-delay</primary></indexterm>
<para>This option causes Nmap to wait at least the given amount of
time between each probe it sends to a given host.  This is
particularly useful in the case of rate limiting.  Solaris machines
(among many others) will usually respond to UDP scan probe packets
with only one ICMP message per second.  Any more than that sent by
Nmap will be wasteful.  A <option>--scan-delay</option> of
<literal moreinfo="none">1s</literal> will keep Nmap at that slow rate.  Nmap tries to
detect rate limiting and adjust the scan delay accordingly, but it
doesn't hurt to specify it explicitly if you already know what rate
works best.</para>

<para>When Nmap adjusts the scan delay upward to cope with rate
limiting, the scan slows down dramatically.  The
<option>--max-scan-delay</option> option specifies the largest delay
that Nmap will allow.  Setting this value too low can lead to wasteful
packet retransmissions and possible missed ports when the target
implements strict rate limiting.</para>

<para>Another use of <option>--scan-delay</option> is to evade
threshold based intrusion detection and prevention systems (IDS/IPS).</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term><option>--defeat-rst-ratelimit</option></term>
        <listitem>

<indexterm significance="normal"><primary>--defeat-rst-ratelimit</primary></indexterm>

<para>Many hosts have long used rate limiting to reduce the number
of ICMP error messages (such as port-unreachable errors) they send.
Some systems now apply similar rate limits to the RST (reset)
packets they generate.  This can slow Nmap down dramatically as it
adjusts its timing to reflect those rate limits.  You can tell Nmap to
ignore those rate limits (for port scans such as SYN scan which
<emphasis>don't</emphasis> treat nonresponsive ports as
<literal moreinfo="none">open</literal>) by specifying
<option>--defeat-rst-ratelimit</option>.</para>

<para>Using this option can reduce accuracy, as some ports will appear
nonresponse because Nmap didn't wait long enough for a rate-limited
RST response.  With a SYN
scan, the non-response results in the port being labeled
<literal moreinfo="none">filtered</literal> rather than the <literal moreinfo="none">closed</literal>
state we see when RST packets are received.  This optional is useful
when you only care about open ports, and distinguishing between
<literal moreinfo="none">closed</literal> and <literal moreinfo="none">filtered</literal> ports isn't
worth the extra time.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-T
          &lt;Paranoid|Sneaky|Polite|Normal|Aggressive|Insane&gt;</option>
          (Set a timing template)
        </term>
        <listitem>

<indexterm significance="normal"><primary>--T</primary></indexterm>
<para>While the fine grained timing controls discussed in the previous
section are powerful and effective, some people find them confusing.
Moreover, choosing the appropriate values can sometimes take more time
than the scan you are trying to optimize.  So Nmap offers a simpler
approach, with six timing templates.  You can specify them with the
<option>-T</option> option and their number (0 - 5) or their name.
The template names are paranoid (0), sneaky (1), polite (2), normal
(3), aggressive (4), and insane (5).  The first two are for IDS
evasion.  Polite mode slows down the scan to use less bandwidth and
target machine resources.  Normal mode is the default and so
<option>-T3</option> does nothing. Aggressive mode speeds scans up by
making the assumption that you are on a reasonably fast and reliable
network.  Finally Insane mode assumes that you are on an
extraordinarily fast network or are willing to sacrifice some accuracy
for speed.</para>

<para>These templates allow the user to specify how aggressive they
wish to be, while leaving Nmap to pick the exact timing values.  The
templates also make some minor speed adjustments for which fine
grained control options do not currently exist.  For example,
<option>-T4</option> prohibits the dynamic scan delay from exceeding
10ms for TCP ports and <option>-T5</option> caps that value at 5
milliseconds.  Templates can be used in combination with fine grained
controls, and the fine-grained controls will you specify will take
precedence over the timing template default for that parameter.  I
recommend using <option>-T4</option> when scanning reasonably modern
and reliable networks.  Keep that option even when you add fine
grained controls so that you benefit from those extra minor
optimizations that it enables.</para>

<para>If you are on a decent broadband or ethernet connection, I would
recommend always using <option>-T4</option>.  Some people love
<option>-T5</option> though it is too aggressive for my taste.  People
sometimes specify <option>-T2</option> because they think it is less
likely to crash hosts or because they consider themselves to be polite
in general.  They often don't realize just how slow <option>-T
Polite</option> really is.  Their scan may take ten times longer than a
default scan.
Machine crashes and bandwidth problems are rare with the
default timing options (<option>-T3</option>) and so I normally
recommend that for cautious scanners.  Omitting version detection is
far more effective than playing with timing values at reducing these
problems.</para>

<para>While <option>-T0</option> and <option>-T1</option> may be
useful for avoiding IDS alerts, they will take an extraordinarily long
time to scan thousands of machines or ports.  For such a long scan,
you may prefer to set the exact timing values you need rather than
rely on the canned <option>-T0</option> and <option>-T1</option>
values.</para>

<para>The main effects of <option>T0</option> are serializing the scan
so only one port is scanned at a time, and waiting five minutes
between sending each probe.  <option>T1</option> and
<option>T2</option> are similar but they only wait 15 seconds and 0.4
seconds, respectively, between probes.  <option>T3</option> is Nmap's
default behavior, which includes parallelization.  <option>T4</option>
does the equivalent of <option>--max-rtt-timeout 1250
--initial-rtt-timeout 500 --max-retries 6</option> and sets the maximum TCP scan delay
to 10 milliseconds.  <option>T5</option> does the equivalent of
<option>--max-rtt-timeout 300 --min-rtt-timeout 50
--initial-rtt-timeout 250 --max-retries 2 --host-timeout 15m</option> as well as
setting the maximum TCP scan delay to 5ms.</para>

        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1 id="man-bypass-firewalls-ids">
    <title>Firewall/IDS Evasion and Spoofing</title>

<para>Many Internet pioneers envisioned a global open network with a
universal IP address space allowing virtual connections between any
two nodes.  This allows hosts to act as true peers, serving and
retrieving information from each other.  People could access all of
their home systems from work, changing the climate control settings or
unlocking the doors for early guests.  This vision of universal
connectivity has been stifled by address space shortages and security
concerns.  In the early 1990s, organizations began deploying
firewalls for the express purpose of reducing connectivity.  Huge
networks were cordoned off from the unfiltered Internet by application
proxies, network address translation, and packet filters.  The
unrestricted flow of information gave way to tight regulation of
approved communication channels and the content that passes over
them.</para>

<para>Network obstructions such as firewalls can make mapping a
network exceedingly difficult.  It will not get any easier, as
stifling casual reconnaissance is often a key goal of implementing the
devices.   Nevertheless, Nmap offers many features to help understand these
complex networks, and to verify that filters are working as intended.
It even supports mechanisms for bypassing poorly implemented
defenses.  One of the best methods of understanding your
network security posture is to try to defeat it.  Place yourself in
the mindset of an attacker, and deploy techniques from this section
against your networks.  Launch an FTP bounce scan, Idle scan,
fragmentation attack, or try to tunnel through one of your own
proxies.</para>

<para>In addition to restricting network activity, companies are
increasingly monitoring traffic with intrusion detection systems
(IDS).  All of the major IDSs ship with rules designed to detect Nmap
scans because scans are sometimes a precursor to attacks.  Many of
these products have recently morphed into intrusion
<emphasis>prevention</emphasis> systems (IPS) that actively block
traffic deemed malicious.  Unfortunately for network administrators
and IDS vendors, reliably detecting bad intentions by analyzing packet
data is a tough problem.  Attackers with patience, skill, and the help
of certain Nmap options can usually pass by IDSs undetected.
Meanwhile, administrators must cope with large numbers of false
positive results where innocent activity is misdiagnosed and alerted
on or blocked.</para>

<para>Occasionally people suggest that Nmap should not offer features
for evading firewall rules or sneaking past IDSs.  They argue
that these features are just as likely to be misused by attackers as
used by administrators to enhance security.  The problem with this
logic is that these methods would still be used by attackers, who
would just find other tools or patch the functionality into Nmap.
Meanwhile, administrators would find it that much harder to do their
jobs.  Deploying only modern, patched FTP servers is a far more
powerful defense than trying to prevent the distribution of tools
implementing the FTP bounce attack.
</para>

<para>There is no magic bullet (or Nmap option) for detecting and
subverting firewalls and IDS systems.  It takes skill and experience.
A tutorial is beyond the scope of this reference guide, which only
lists the relevant options and describes what they do.</para>

<variablelist>
      <varlistentry>
        <term>
          <option>-f</option> (fragment packets);
          <option>--mtu</option> (using the specified MTU)
        </term>

        <listitem>
          <indexterm significance="normal"><primary>-f</primary></indexterm>
          <indexterm significance="normal"><primary>--mtu</primary></indexterm>
          <para>The <option>-f</option> option causes the requested scan (including
          ping scans) to use tiny fragmented IP packets. The idea
          is to split up the TCP header over several packets to
          make it harder for packet filters, intrusion detection
          systems, and other annoyances to detect what you are
          doing. Be careful with this! Some programs have trouble
          handling these tiny packets. The old-school sniffer named
          Sniffit segmentation faulted immediately upon receiving
          the first fragment. Specify this option once, and Nmap
          splits the packets into 8 bytes or less after the IP
          header. So a 20-byte TCP header would be split into 3
          packets. Two with eight bytes of the TCP header, and one
          with the final four. Of course each fragment also has an
          IP header. Specify <option>-f</option> again to use 16 bytes per fragment
          (reducing the number of fragments). Or you can specify
          your own offset size with the <option>--mtu</option> option. Don't also
          specify <option>-f</option> if you use <option>--mtu</option>. The offset must be a
          multiple of 8. While fragmented packets won't get by
          packet filters and firewalls that queue all IP fragments,
          such as the CONFIG_IP_ALWAYS_DEFRAG option in the Linux
          kernel, some networks can't afford the performance hit
          this causes and thus leave it disabled. Others can't enable
          this because fragments may take different routes into their
          networks.  Some source
          systems defragment outgoing packets in the kernel. Linux
          with the iptables connection tracking module is one such
          example. Do a scan while a sniffer such as Ethereal
          is running to ensure that sent packets are
          fragmented.  If your host OS is causing problems, try the <option>--send-eth</option> option to bypass the IP layer and send raw ethernet frames.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-D &lt;decoy1 [,decoy2][,ME],...&gt;</option>
          (Cloak a scan with decoys)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-D</primary></indexterm>
          <para>Causes a decoy scan to be performed, which makes it
          appear to the remote host that the host(s) you specify as
          decoys are scanning the target network too. Thus their
          IDS might report 5-10 port scans from unique IP
          addresses, but they won't know which IP was scanning them
          and which were innocent decoys. While this can be
          defeated through router path tracing, response-dropping,
          and other active mechanisms, it is generally an
          effective technique for hiding your IP
          address.</para>

          <para>Separate each decoy host with commas, and you can
          optionally use <literal moreinfo="none">ME</literal> as one of the decoys to represent the
          position for your real IP address. If you put
          <literal moreinfo="none">ME</literal> in the 6th position or later, some common port scan
          detectors (such as Solar Designer's excellent scanlogd)
          are unlikely to show your IP address at all. If you don't
          use <literal moreinfo="none">ME</literal>, nmap will put you in a random position.</para>
          <para>Note that the hosts you use as decoys should be up
          or you might accidentally SYN flood your targets. Also it
          will be pretty easy to determine which host is scanning
          if only one is actually up on the network. You might want
          to use IP addresses instead of names (so the decoy
          networks don't see you in their nameserver logs).</para>

          <para>Decoys are used both in the initial ping scan (using
          ICMP, SYN, ACK, or whatever) and during the actual port
          scanning phase. Decoys are also used during remote OS
          detection (<option>-O</option>).  Decoys do not work with version detection
          or TCP connect scan.</para>

          <para>It is worth noting that using too many decoys may
          slow your scan and potentially even make it less
          accurate. Also, some ISPs will filter out your spoofed
          packets, but many do not restrict
          spoofed IP packets at all.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-S &lt;IP_Address&gt;</option> (Spoof source address)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-S</primary></indexterm>
          <para>In some circumstances, 
          Nmap may not be able to determine your
          source address ( 
          Nmap will tell you if this is the
          case). In this situation, use <option>-S</option> with the IP address of
          the interface you wish to send packets through.</para>

          <para>Another possible use of this flag is to spoof the scan
          to make the targets think that <emphasis>someone
          else</emphasis> is scanning them. Imagine a company being
          repeatedly port scanned by a competitor!  The
          <option>-e</option> option would generally be required for
          this sort of usage, and <option>-P0</option> would normally
          be advisable as well.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-e &lt;interface&gt;</option> (Use specified interface)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-e</primary></indexterm>
          <para>Tells Nmap what interface to send and receive
          packets on. Nmap should be able to detect this
          automatically, but it
          will tell you if it cannot.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--source-port &lt;portnumber&gt;;</option>
          <option>-g &lt;portnumber&gt;</option> (Spoof source port number)
        </term>
        <listitem>

<indexterm significance="normal"><primary>--source-port</primary></indexterm>
<indexterm significance="normal"><primary>--g</primary></indexterm>
<para>One surprisingly common misconfiguration is to trust traffic
based only on the source port number.  It is easy to understand how
this comes about.  An administrator will set up a shiny new firewall,
only to be flooded with complains from ungrateful users whose
applications stopped working.  In particular, DNS may be broken
because the UDP DNS replies from external servers can no longer enter
the network.  FTP is another common example.  In active FTP transfers,
the remote server tries to establish a connection back to the client
to transfer the requested file.</para>

<para>Secure solutions to these problems exist, often in the form of
application-level proxies or protocol-parsing firewall modules.
Unfortunately there are also easier, insecure solutions.  Noting that
DNS replies come from port 53 and active ftp from port 20, many admins
have fallen into the trap of simply allowing incoming traffic from
those ports.  They often assume that no attacker would notice and
exploit such firewall holes.  In other cases, admins consider this a
short-term stop-gap measure until they can implement a more secure
solution.  Then they forget the security upgrade.
</para>

<para>Overworked network administrators are not the only ones to fall
into this trap.  Numerous products have shipped with these insecure
rules.  Even Microsoft has been guilty.  The IPsec filters that
shipped with Windows 2000 and Windows XP contain an implicit rule that
allows all TCP or UDP traffic from port 88 (Kerberos).  In another well-known
case, versions of the Zone Alarm personal firewall up to 2.1.25
allowed any incoming UDP packets with the source port 53 (DNS) or 67
(DHCP).</para>

<para>Nmap offers the <option>-g</option> and
<option>--source-port</option> options (they are equivalent) to exploit these
weaknesses.  Simply provide a port number and Nmap will send packets
from that port where possible.  Nmap must use different port numbers
for certain OS detection tests to work properly, and DNS requests
ignore the <option>--source-port</option> flag because Nmap relies on system
libraries to handle those.  Most TCP scans, including SYN scan,
support the option completely, as does UDP scan.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--data-length &lt;number&gt;</option> (Append random
          data to sent packets)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--data-length</primary></indexterm>
          <para>Normally Nmap sends minimalist packets containing only
          a header. So its TCP packets are generally 40
          bytes and ICMP echo requests are just 28. This option
          tells Nmap to append the given number of random bytes to
          most of the packets it sends. OS detection (<option>-O</option>) packets
          are not affected because accuracy there requires probe consistency, but most pinging and portscan packets
          support this. It slows things down a little, but can make a scan slightly less
          conspicuous.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--ttl &lt;value&gt;</option> (Set IP time-to-live field)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--ttl</primary></indexterm>
          <para>Sets the IPv4 time-to-live field in sent packets to
          the given value.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--randomize-hosts</option> (Randomize target host order)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--randomize-hosts</primary></indexterm>
          <para>Tells Nmap to shuffle each group of up to 8096 hosts
          before it scans them. This can make the scans less obvious
          to various network monitoring systems, especially when you
          combine it with slow timing options.  If you
          want to randomize over larger group sizes, increase
          PING_GROUP_SZ in <filename moreinfo="none">nmap.h</filename> and recompile.
          An alternative solution is to generate the target IP list
          with a list scan (<option>-sL -n -oN
          <replaceable>filename</replaceable></option>), randomize it
          with a Perl script, then provide the whole list to Nmap with
          <option>-iL</option>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--spoof-mac &lt;mac address, prefix, or vendor
          name&gt;</option> (Spoof MAC address)
        </term>
        <listitem>

        <indexterm significance="normal"><primary>--spoof-mac</primary></indexterm>
          <para>Asks Nmap to use the given MAC address for all of the
  raw ethernet frames it sends.  This option implies
  <option>--send-eth</option> to ensure that Nmap actually sends
  ethernet-level packets.  The MAC given can take several formats.  If
  it is simply the string <quote>0</quote>, Nmap chooses a completely random MAC
  for the session.  If the given string is an even number of hex
  digits (with the pairs optionally separated by a colon), Nmap will
  use those as the MAC.  If less than 12 hex digits are provided, Nmap
  fills in the remainder of the 6 bytes with random values.  If the
  argument isn't a 0 or hex string, Nmap looks through
  <filename moreinfo="none">nmap-mac-prefixes</filename> to find a vendor name containing the given string
  (it is case insensitive).  If a match is found, Nmap uses the
  vendor's OUI (3-byte prefix) and fills out the remaining 3 bytes
  randomly.  Valid <option>--spoof-mac</option> argument examples are <literal moreinfo="none">Apple</literal>, <literal moreinfo="none">0</literal>,
  <literal moreinfo="none">01:02:03:04:05:06</literal>, <literal moreinfo="none">deadbeefcafe</literal>, <literal moreinfo="none">0020F2</literal>, and <literal moreinfo="none">Cisco</literal>.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--badsum</option> (Send packets with bogus TCP/UDP checksums)
        </term>
        <listitem>

        <indexterm significance="normal"><primary>--badsum</primary></indexterm>
          <para>Asks Nmap to use an invalid TCP or UDP checksum for
  packets sent to target hosts.  Since virtually all
  host IP stacks properly drop these packets, any responses received
  are likely coming from a firewall or IDS that didn't bother to
  verify the checksum.  For more details on this technique, see <ulink url="http://www.phrack.org/phrack/60/p60-0x0c.txt"/></para>
        </listitem>
      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1 id="man-output">
    <title>Output</title>

    <para>Any security tools is only as useful as the output it
    generates.  Complex tests and algorithms are of little value if
    they aren't presented in an organized and comprehensible fashion.
    Given the number of ways Nmap is used by people and other
    software, no single format can please everyone.  So Nmap offers
    several formats, including the interactive mode for humans to read
    directly and XML for easy parsing by software.</para>

<para>In addition to offering different output formats, Nmap provides
options for controlling the verbosity of output as well as debugging
messages.  Output types may be sent to standard output or to named
files, which Nmap can append to or clobber.  Output files may also be
used to resume aborted scans.</para>

<para>Nmap makes output available in five different formats.
The default is called <literal moreinfo="none">interactive output</literal>, and it is sent to standard
output (stdout).  There is also <literal moreinfo="none">normal output</literal>,
which is similar to <literal moreinfo="none">interactive</literal> except that it
displays less runtime information and warnings since it is expected to
be analyzed after the scan completes rather than interactively.</para>

<para>XML output is one of the most important output types, as it can
be converted to HTML, easily parsed by programs such as Nmap graphical
user interfaces, or imported into databases.</para>

<para>The two remaining output types are the simple <literal moreinfo="none">grepable
output</literal> which includes most information for a target host on
a single line, and <literal moreinfo="none">sCRiPt KiDDi3 0utPUt</literal> for users
who consider themselves |&lt;-r4d.</para>

<para>While interactive output is the default and has no associated
command-line options, the other four format options use the same
syntax.  They take one argument, which is the filename that results
should be stored in.  Multiple formats may be specified, but each
format may only be specified once.  For example, you may wish to save
normal output for your own review while saving XML of the same scan
for programmatic analysis.  You might do this with the options
<option>-oX myscan.xml -oN myscan.nmap</option>.  While this chapter
uses the simple names like <literal moreinfo="none">myscan.xml</literal> for brevity,
more descriptive names are generally recommended.  The names chosen
are a matter of personal preference, though I use long ones that
incorporate the scan date and a word or two describing the scan, placed
in a directory named after the company I'm scanning.</para>

<para>While these options save results to files, Nmap still prints
interactive output to stdout as usual.  For example, the command
<command moreinfo="none">nmap -oX myscan.xml target</command> prints XML to
<filename moreinfo="none">myscan.xml</filename> and fills standard output with the same interactive results it would have printed if <option>-oX</option>
wasn't specified at all.  You can change this by passing a hyphen
character as the argument to one of the format types.  This causes
Nmap to deactivate interactive output, and instead print
results in the format you specified to the standard output stream.  So the
command <command moreinfo="none">nmap -oX - target</command> will send only XML output to
stdout.  Serious errors may still be printed to the normal error
stream, stderr.</para>

<para>Unlike some Nmap arguments, the space between the logfile option
flag (such as <option>-oX</option>) and the filename or hyphen is
mandatory.  If you omit the flags and give arguments such as
<option>-oG-</option> or <option>-oXscan.xml</option>, a backwards
compatibility feature of Nmap will cause the creation of
<emphasis>normal format</emphasis> output files named
<filename moreinfo="none">G-</filename> and <filename moreinfo="none">Xscan.xml</filename>
respectively.</para>

<para>Nmap also offers options to control scan verbosity and to append
to output files rather than clobbering them.  All of these options are
described below.</para>

<variablelist><title>Nmap Output Formats</title>
      <varlistentry>
        <term>
        <option>-oN &lt;filespec&gt;</option> (Normal output)</term>
        <listitem>
          <indexterm significance="normal"><primary>-oN</primary></indexterm>
          <para>Requests that <literal moreinfo="none">normal output</literal> be
          directed to the given filename.  As discussed above, this
          differs slightly from <literal moreinfo="none">interactive output</literal>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-oX &lt;filespec&gt;</option> (XML output)</term>
        <listitem>

          <indexterm significance="normal"><primary>-oX</primary></indexterm>
          <para>Requests that <literal moreinfo="none">XML output</literal> be
          directed to the given filename.  Nmap includes a document
          type definition (DTD) which allows XML parsers to validate
          Nmap XML output.  While it is primarily intended for
          programmatic use, it can also help humans interpret Nmap XML
          output.  The DTD defines the legal elements of the format,
          and often enumerates the attributes and values they can take
          on.  The latest version is always available from <ulink url="http://www.insecure.org/nmap/data/nmap.dtd"/>.</para>

          <para>XML offers a stable format that is easily parsed by
          software. Free XML parsers are available for all major
          computer languages, including C/C++, Perl, Python, and
          Java. People have even written bindings for most of these
          languages to handle Nmap output and execution specifically.
          Examples are <ulink url="http://sourceforge.net/projects/nmap-scanner/">Nmap::Scanner</ulink>
          and <ulink url="http://www.nmapparser.com">Nmap::Parser</ulink> in Perl
          CPAN.  In almost all cases that a non-trivial application
          interfaces with Nmap, XML is the preferred format.</para>

          <para>The XML output references an XSL stylesheet which can
          be used to format the results as HTML.  The easiest way to
          use this is simply to load the XML output in a web browser
          such as Firefox or IE.  By default, this will only work on
          the machine you ran Nmap on (or a similarly configured one)
          due to the hard-coded <filename moreinfo="none">nmap.xsl</filename>
          filesystem path.  Use the <option>--webxml</option> or
          <option>--stylesheet</option> options to create portable XML
          files that render as HTML on any web-connected
          machine.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-oS &lt;filespec&gt;</option> (ScRipT KIdd|3 oUTpuT)</term>
        <listitem>
        <indexterm significance="normal"><primary>-oS</primary></indexterm>
   <para>Script kiddie output is like interactive output, except that
   it is post-processed to better suit the l33t HaXXorZ who
   previously looked down on Nmap due to its consistent capitalization
   and spelling.  Humor impaired people should note that this option
   is making fun of the script kiddies before flaming me for
   supposedly <quote>helping them</quote>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
        <option>-oG &lt;filespec&gt;</option> (Grepable output)</term>
        <listitem>

        <indexterm significance="normal"><primary>-oG</primary></indexterm>
<para>This output format is covered last because it is deprecated.
The XML output format is far more powerful, and is nearly as
convenient for experienced users.  XML is a standard for which dozens
of excellent parsers are available, while grepable output is my own
simple hack.  XML is extensible to support new Nmap features as they
are released, while I often must omit those features from grepable
output for lack of a place to put them.</para>

<para>Nevertheless, grepable output is still quite popular.  It is a
simple format that lists each host on one line and can be trivially
searched and parsed with standard UNIX tools such as grep, awk, cut,
sed, diff, and Perl.  Even I usually use it for one-off tests done at the
command line.  Finding all the hosts with the ssh port open or that
are running Solaris takes only a simple grep to identify the hosts,
piped to an awk or cut command to print the desired fields.</para>

<para>Grepable output consists of comments (lines starting with a
pound (#)) and target lines.  A target line includes a combination
of 6 labeled fields, separated by tabs and followed with a colon.
The fields are <literal moreinfo="none">Host</literal>, <literal moreinfo="none">Ports</literal>,
<literal moreinfo="none">Protocols</literal>, <literal moreinfo="none">Ignored State</literal>,
<literal moreinfo="none">OS</literal>, <literal moreinfo="none">Seq Index</literal>,
<literal moreinfo="none">IPID</literal>, and <literal moreinfo="none">Status</literal>.</para>

<para>The most important of these fields is generally
<literal moreinfo="none">Ports</literal>, which gives details on each interesting
port.  It is a comma separated list of port entries.  Each port entry
represents one interesting port, and takes the form of seven slash
(/) separated subfields.  Those subfields are: <literal moreinfo="none">Port
number</literal>, <literal moreinfo="none">State</literal>, <literal moreinfo="none">Protocol</literal>,
<literal moreinfo="none">Owner</literal>, <literal moreinfo="none">Service</literal>, <literal moreinfo="none">SunRPC
info</literal>, and <literal moreinfo="none">Version info</literal>.</para>

<para>As with XML output, this man page does not allow for documenting
the entire format.  A more detailed look at the Nmap grepable output
format is available from <ulink url="http://www.unspecific.com/nmap-oG-output"/>.</para>
        </listitem>
      </varlistentry>

     <varlistentry>
        <term>
        <option>-oA &lt;basename&gt;</option> (Output to all formats)</term>
       <listitem><para>
           <indexterm significance="normal"><primary>-oA</primary></indexterm>
           As a convenience, you may specify <option>-oA
           <replaceable>basename</replaceable></option> to store scan
           results in normal, XML, and grepable formats at once.  They
           are stored in <replaceable>basename</replaceable>.nmap,
           <replaceable>basename</replaceable>.xml, and
           <replaceable>basename</replaceable>.gnmap, respectively.
           As with most programs, you can prefix the filenames with a
           directory path, such as
           <filename moreinfo="none">~/nmaplogs/foocorp/</filename> on UNIX or
           <filename moreinfo="none">c:\hacking\sco</filename> on Windows.</para>
        </listitem>
      </varlistentry>

   </variablelist>

    <variablelist><title>Verbosity and debugging options</title>
      <varlistentry>
        <term>
          <option>-v</option> (Increase verbosity level)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-v</primary></indexterm>
          <para>Increases the verbosity level, causing Nmap to
          print more information about the scan in progress. Open
          ports are shown as they are found and completion time
          estimates are provided when Nmap thinks a scan will take
          more than a few minutes. Use it twice for even greater
          verbosity. Using it more than twice has no effect.</para>

          <para>Most changes only affect interactive output, and some
          also affect normal and script kiddie output.  The other
          output types are meant to be processed by machines, so Nmap
          can give substantial detail by default in those formats
          without fatiguing a human user.  However, there are a few
          changes in other modes where output size can be reduced
          substantially by omitting some detail.  For example, a
          comment line in the grepable output that provides a list of
          all ports scanned is only printed in verbose mode because it
          can be quite long.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-d [level]</option> (Increase or set debugging level)
        </term>
        <listitem>

        <indexterm significance="normal"><primary>-d</primary></indexterm>
<para>When even verbose mode doesn't provide sufficient data for you,
debugging is available to flood you with much more!  As with the
verbosity option (<option>-v</option>), debugging is enabled with a
command-line flag (<option>-d</option>) and the debug level can be
increased by specifying it multiple times.  Alternatively, you can set
a debug level by giving an argument to <option>-d</option>.  For
example, <option>-d9</option> sets level nine.  That is the highest
effective level and will produce thousands of lines unless you run a
very simple scan with very few ports and targets.</para>

<para>Debugging output is useful when a bug is suspected in Nmap,
or if you are simply confused as to what Nmap is doing and why.  As this
feature is mostly intended for developers, debug lines aren't always
self-explanatory.  You may get something like: <computeroutput moreinfo="none">Timeout
vals: srtt: -1 rttvar: -1 to: 1000000 delta 14987 ==&gt; srtt: 14987
rttvar: 14987 to: 100000</computeroutput>.  If you don't understand a line, your only recourses
are to ignore it, look it up in the source code, or request help from
the development list (nmap-dev).  Some lines are self explanatory, but
the messages become more obscure as the debug level is
increased.</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--packet-trace</option> (Trace packets and data sent and received)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--packet-trace</primary></indexterm>
          <para>Causes Nmap to print a summary of every packet sent
          or received. This is often used for debugging, but is
          also a valuable way for new users to understand exactly
          what Nmap is doing under the covers. To avoid printing
          thousands of lines, you may want to specify a limited
          number of ports to scan, such as <option>-p20-30</option>.  If you only care
          about the goings on of the version detection subsystem, use
          <option>--version-trace</option> instead.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--iflist</option> (List interfaces and routes)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--iflist</primary></indexterm>
          <para>Prints the interface list and system routes as
          detected by Nmap.  This is useful for debugging routing
          problems or device mischaracterization (such as
          Nmap treating a PPP connection as Ethernet).</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--log-errors</option> (Log errors/warnings to normal mode output file)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--log-errors</primary></indexterm>
          <para>Warnings and errors printed by Nmap usually go only to
          the screen (interactive output), leaving any specified
          normal-fomat output files uncluttered.  But when you do want
          to see those messages in the normal output file you
          specified, add this option. It is useful when you aren't
          watching the interactive output or are trying to debug a
          problem.  The messages will also still appear in interactive
          mode.  This will not work for most errors related to bad
          command-line arguments, as Nmap may not have initialized its
          output files yet.  In addition, some Nmap error/warning
          messages use a different system that does not yet support
          this option.  An alternative to using this option is
          redirecting interactive output (including the standard error
          stream) to a file.  While most UNIX shells make that
          approach easy, it can be difficult on Windows.</para>
        </listitem>
      </varlistentry>

   </variablelist>

   <variablelist><title>Miscellaneous output options</title>

      <varlistentry>
        <term>
          <option>--append-output</option> (Append to rather than clobber output files)
        </term>
        <listitem>
           <indexterm significance="normal"><primary>--append-output</primary></indexterm>
           <para>When you specify a filename to an output format flag
           such as <option>-oX</option> or <option>-oN</option>, that
           file is overwritten by default.  If you prefer to keep the
           existing content of the file and append the new results,
           specify the <option>--append-output</option> option.  All
           output filenames specified in that Nmap execution will then
           be appended to rather than clobbered.  This doesn't work
           well for XML (<option>-oX</option>) scan data as the
           resultant file generally won't parse properly until you fix
           it up by hand.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--resume &lt;filename&gt;</option> (Resume aborted scan)
        </term>
        <listitem>

          <indexterm significance="normal"><primary>--resume</primary></indexterm>
          <para>Some extensive Nmap runs take a very long time -- on
          the order of days.  Such scans don't always run to
          completion.  Restrictions may prevent Nmap from being run
          during working hours, the network could go down, the machine
          Nmap is running on might suffer a planned or unplanned
          reboot, or Nmap itself could crash.  The admin running Nmap
          could cancel it for any other reason as well, by pressing
          <keycap moreinfo="none">ctrl-C</keycap>.  Restarting the whole scan from the
          beginning may be undesirable.  Fortunately, if normal
          (<option>-oN</option>) or grepable (<option>-oG</option>)
          logs were kept, the user can ask Nmap to resume scanning
          with the target it was working on when execution ceased.
          Simply specify the <option>--resume</option> option and pass
          the normal/grepable output file as its argument.  No other
          arguments are permitted, as Nmap parses the output file to
          use the same ones specified previously.  Simply call Nmap as
          <command moreinfo="none">nmap --resume
          <replaceable>logfilename</replaceable></command>.  Nmap will
          append new results to the data files specified in the
          previous execution.  Resumption does not support the XML
          output format because combining the two runs into one valid
          XML file would be difficult.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--stylesheet &lt;path or URL&gt;</option> (Set XSL stylesheet to transform XML output)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--stylesheet</primary></indexterm>
          <para>Nmap ships with an XSL stylesheet named
          <filename moreinfo="none">nmap.xsl</filename> for viewing or translating XML
          output to HTML.  The XML output includes an <literal moreinfo="none">xml-stylesheet</literal>
          directive which points to <filename moreinfo="none">nmap.xml</filename>
          where it was initially installed by Nmap (or in the current
          working directory on Windows).  Simply load Nmap's XML
          output in a modern web browser and it should retrieve
          <filename moreinfo="none">nmap.xsl</filename> from the filesystem and use it
          to render results.  If you wish to use a different
          stylesheet, specify it as the argument to
          <option>--stylesheet</option>.  You must pass the full
          pathname or URL.  One common invocation is
          <option>--stylesheet
          http://www.insecure.org/nmap/data/nmap.xsl</option>.  This
          tells a browser to load the latest version of the stylesheet
          from Insecure.Org.  The <option>--webxml</option> option
          does the same thing with less typing and memorization.
          Loading the XSL from Insecure.Org makes it easier to view results on
          a machine that doesn't have Nmap (and thus
          <filename moreinfo="none">nmap.xsl</filename>) installed.  So the URL is
          often more useful, but the local filesystem location of
          nmap.xsl is used by default for privacy reasons.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--webxml</option> (Load stylesheet from Insecure.Org)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--webxml</primary></indexterm>
          <para>This convenience option is simply an alias for
          <option>--stylesheet http://www.insecure.org/nmap/data/nmap.xsl</option>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--no_stylesheet</option> (Omit XSL stylesheet declaration from XML)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--no_stylesheet</primary></indexterm>
          <para>Specify  this  option  to prevent Nmap from associating any XSL
              stylesheet with its XML output.  The  <literal moreinfo="none">xml-stylesheet</literal>  directive
              is omitted.</para>
        </listitem>
      </varlistentry>



    </variablelist>
  </refsect1>

  <refsect1 id="man-misc-options">
    <title>Miscellaneous Options</title>
    <para>This section describes some important (and not-so-important)
    options that don't really fit anywhere else.</para>

    <variablelist>
      <varlistentry>
        <term>
          <option>-6</option> (Enable IPv6 scanning)
        </term>
        <listitem>

          <indexterm significance="normal"><primary>-6</primary></indexterm>
          <indexterm significance="normal"><primary>IPv6</primary></indexterm>
          <para>Since 2002, Nmap has offered IPv6 support for its most
          popular features.  In particular, ping scanning (TCP-only),
          connect scanning, and version detection all support IPv6.
          The command syntax is the same as usual except that you also
          add the <option>-6</option> option.  Of course, you must use
          IPv6 syntax if you specify an address rather than a
          hostname.  An address might look like
          <literal moreinfo="none">3ffe:7501:4819:2000:210:f3ff:fe03:14d0</literal>,
          so hostnames are recommended.  The output looks the same as
          usual, with the IPv6 address on the <quote>interesting
          ports</quote> line being the only IPv6 give away.</para>

          <para>While IPv6 hasn't exactly taken the world by storm, it
          gets significant use in some (usually Asian) countries and
          most modern operating systems support it.  To use Nmap
          with IPv6, both the source and target of your scan must be
          configured for IPv6.  If your ISP (like most of them) does
          not allocate IPv6 addresses to you, free tunnel brokers are
          widely available and work fine with Nmap.  One of the better
          ones is run by BT Exact at <ulink url="https://tb.ipv6.btexact.com/"/>.  I have also used one
          that Hurricane Electric provides at <ulink url="http://ipv6tb.he.net/"/>.  6to4 tunnels are another
          popular, free approach.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-A</option> (Aggressive scan options)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-A</primary></indexterm>
          <para>This option enables additional advanced and
          aggressive options. I haven't decided exactly which it
          stands for yet. Presently this enables OS Detection
          (<option>-O</option>) and version scanning (<option>-sV</option>). More features may be
          added in the future. The point is to enable a
          comprehensive set of scan options without people having
          to remember a large set of flags. This option only
          enables features, and not timing options (such as <option>-T4</option>) or
          verbosity options (<option>-v</option>) that you might want as
          well.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--datadir &lt;directoryname&gt;</option> (Specify custom Nmap data file location)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--datadir</primary></indexterm>
          <para>Nmap obtains some special data at runtime in files
          named <filename moreinfo="none">nmap-service-probes</filename>,
          <filename moreinfo="none">nmap-services</filename>,
          <filename moreinfo="none">nmap-protocols</filename>,
          <filename moreinfo="none">nmap-rpc</filename>,
          <filename moreinfo="none">nmap-mac-prefixes</filename>, and
          <filename moreinfo="none">nmap-os-fingerprints</filename>.  Nmap first
          searches these files in the directory specified with the
          <option>--datadir</option> option (if any). Any files not
          found there, are searched for in the directory specified by
          the NMAPDIR environmental variable. Next comes <filename moreinfo="none">~/.nmap</filename> for
          real and effective UIDs (POSIX systems only) or location of
          the Nmap executable (Win32 only), and then a compiled-in
          location such as <filename moreinfo="none">/usr/local/share/nmap</filename> or <filename moreinfo="none">/usr/share/nmap</filename>
          . As a last resort, Nmap will look in the current
          directory.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--send-eth</option> (Use raw ethernet sending)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--send-eth</primary></indexterm>
          <para>Asks Nmap to send packets at the raw ethernet (data
          link) layer rather than the higher IP (network) layer. By
          default, Nmap chooses the one which is generally best for
          the platform it is running on. Raw sockets (IP layer) are
          generally most efficient for UNIX machines, while ethernet
          frames are required for Windows operation since Microsoft
          disabled raw socket support. Nmap still uses raw IP packets
          on UNIX despite this option when there is no other choice
          (such as non-ethernet connections).</para>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--send-ip</option> (Send at raw IP level)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--send-ip</primary></indexterm>
          <para>Asks Nmap to send packets via raw IP sockets rather
          than sending lower level ethernet frames. It is the
          complement to the <option>--send-eth</option> option discussed
          previously.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--privileged</option> (Assume that the user is fully privileged)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--privileged</primary></indexterm>
          <para>Tells Nmap to simply assume that it is privileged
          enough to perform raw socket sends, packet sniffing, and
          similar operations that usually require root privileges on
          UNIX systems. By default Nmap quits if such operations are
          requested but geteuid() is not
          zero. <option>--privileged</option> is useful with Linux
          kernel capabilities and similar systems that may be
          configured to allow unprivileged users to perform raw-packet
          scans. Be sure to provide this option flag before any flags
          for options that require privileges (SYN scan, OS detection,
          etc.). The NMAP_PRIVILEGED variable may be set as an
          equivalent alternative to
          <option>--privileged</option>.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>--interactive</option> (Start in interactive mode)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>--interactive</primary></indexterm>
          <para>Starts Nmap in interactive mode, which offers an
          interactive Nmap prompt allowing easy launching of
          multiple scans (either synchronously or in the
          background). This is useful for people who scan from
          multi-user systems as they often want to test their
          security without letting everyone else on the system know
          exactly which systems they are scanning. Use
          <option>--interactive</option> to activate this mode and then type <keycap moreinfo="none">h</keycap> for
          help. This option is rarely used because proper shells
          are usually more familiar and feature-complete.  This option
          includes a bang (!) operator for executing shell commands,
          which is one of many reasons not to install Nmap setuid root.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-V</option>; <option>--version</option> (Print version number)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-V</primary></indexterm>
          <indexterm significance="normal"><primary>--version</primary></indexterm>
          <para>Prints the Nmap version number and exits.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>
          <option>-h</option>; <option>--help</option> (Print help summary page)
        </term>
        <listitem>
          <indexterm significance="normal"><primary>-h</primary></indexterm>
          <indexterm significance="normal"><primary>--help</primary></indexterm>
          <para>Prints a short help screen with the most common
          command flags.  Running Nmap without any arguments does the
          same thing.</para>
        </listitem>
      </varlistentry>

    </variablelist>
  </refsect1>

  <refsect1 id="man-runtime-interaction">
    <title>Runtime Interaction</title>
 
    <indexterm significance="normal"><primary>runtime interaction</primary></indexterm>
    <para>During the execution of nmap, all key presses are
    captured. This allows you to interact with the program
    without aborting and restarting it. Certain special
    keys will change options, while any other keys will print out a
    status message telling you about the scan. The convention is
    that 
    <emphasis>lowercase letters increase</emphasis> the
    amount of printing, and 
    <emphasis>uppercase letters decrease</emphasis> the
    printing.  You may also press ‘<emphasis>?</emphasis>’ for help.</para>
    <variablelist>
      <varlistentry>
        <term>
          <option>v</option> / <option>V</option>
        </term>
        <listitem>
          <para>Increase / Decrease the Verbosity</para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>
          <option>d</option> / <option>D</option>
        </term>
        <listitem>
          <para>Increase / Decrease the Debugging Level</para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>
          <option>p</option> / <option>P</option>
        </term>
        <listitem>
          <para>Turn on / off Packet Tracing</para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>
          <option>?</option>
        </term>
        <listitem>
          <para>Print a runtime interaction help screen</para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>
          Anything else
        </term>
        <listitem>
          <para>Print out a status message like this:</para>
          <para>Stats: 0:00:08 elapsed; 111 hosts completed (5 up),
          5 undergoing Service Scan</para>
          <para>Service scan Timing: About 28.00% done; ETC: 16:18
          (0:00:15 remaining)</para>
        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1 id="man-examples">
    <title>Examples</title>
    <para>Here are some Nmap usage examples, from the simple and
    routine to a little more complex and esoteric. Some actual
    IP addresses and domain names are used to make things
    more concrete. In their place you should substitute
    addresses/names from 
    <emphasis>your own network.</emphasis>.  While I don't think
    port scanning other networks is or should be illegal, some network
    administrators don't appreciate unsolicited scanning of their networks and may
    complain.  Getting permission first is the best approach.</para>

    <para>For testing purposes, you have permission to scan the host
    <literal moreinfo="none">scanme.nmap.org</literal>.  This permission only includes
    scanning via Nmap and not testing exploits or denial of service
    attacks.  To conserve bandwidth, please do not initiate more than
    a dozen scans against that host per day.  If this free scanning
    target service is abused, it will be taken down and Nmap will
    report <computeroutput moreinfo="none">Failed to resolve given hostname/IP:
    scanme.nmap.org</computeroutput>.  These permissions also apply to
    the hosts <literal moreinfo="none">scanme2.nmap.org</literal>,
    <literal moreinfo="none">scanme3.nmap.org</literal>, and so on, though those hosts
    do not currently exist.</para>

    <para>
      <userinput moreinfo="none">nmap -v scanme.nmap.org</userinput>
    </para>
    <para>This option scans all reserved TCP ports on the machine
    <literal moreinfo="none">scanme.nmap.org</literal> . The <option>-v</option>
    option enables verbose mode.</para>
    <para>
      <userinput moreinfo="none">nmap -sS -O scanme.nmap.org/24</userinput>
    </para>
    <para>Launches a stealth SYN scan against each machine that is
    up out of the 255 machines on <quote>class C</quote> network where
    Scanme resides. It also tries to determine what
    operating system is running on each host that is up and
    running. This requires root privileges because of the SYN scan
    and OS detection.</para>
    <para>
      <userinput moreinfo="none">nmap -sV -p 22,53,110,143,4564
      198.116.0-255.1-127</userinput>
    </para>

    <para>Launches host enumeration and a TCP scan at the first half
    of each of the 255 possible 8 bit subnets in the 198.116 class B
    address space. This tests whether the systems run sshd, DNS,
    pop3d, imapd, or port 4564. For any of these ports found open,
    version detection is used to determine what application is
    running.</para>

    <para>
    <userinput moreinfo="none">nmap -v -iR 100000 -P0 -p 80</userinput>
    </para>

    <para>Asks Nmap to choose 100,000 hosts at random and scan them
    for web servers (port 80).  Host enumeration is disabled with
    <option>-P0</option> since first sending a couple probes to
    determine whether a host is up is wasteful when you are only
    probing one port on each target host anyway.</para>

    <para>
      <userinput moreinfo="none">nmap -P0 -p80 -oX logs/pb-port80scan.xml -oG
      logs/pb-port80scan.gnmap 216.163.128.20/20</userinput>
    </para>
    <para>This scans 4096 IPs for any webservers (without pinging
    them) and saves the output in grepable and XML formats.</para>

  </refsect1>

  <refsect1 id="man-bugs">
    <title>Bugs</title>

    <para>Like its author, Nmap isn't perfect.  But you can help make
    it better by sending bug reports or even writing patches.  If Nmap
    doesn't behave the way you expect, first upgrade to the latest
    version available from <ulink url="http://www.insecure.org/nmap/"/>.  If the problem persists,
    do some research to determine whether it has already been
    discovered and addressed.  Try Googling the error message or
    browsing the Nmap-dev archives at <ulink url="http://seclists.org/"/>.  Read this full munaual page as
    well.  If nothing comes of this, mail a bug report to
    <email>nmap-dev@insecure.org</email>.  Please include everything
    you have learned about the problem, as well as what version of
    Nmap you are running and what operating system version it is
    running on.  Problem reports and Nmap usage questions sent to
    nmap-dev@insecure.org are far more likely to be answered than
    those sent to Fyodor directly.</para>

    <para>Code patches to fix bugs are even better than bug reports.
    Basic instructions for creating patch files with your changes are
    available at <ulink url="http://www.insecure.org/nmap/data/HACKING"/>.  Patches may
    be sent to nmap-dev (recommended) or to Fyodor directly.</para>
  </refsect1>

  <refsect1 id="man-author">
    <title>Author</title>
    <para>Fyodor 
    <email>fyodor@insecure.org</email>
    (<ulink url="http://www.insecure.org"/>)
    </para>

    <para>Hundreds of people have made valuable contributions to Nmap
    over the years.  These are detailed in the
    <filename moreinfo="none">CHANGELOG</filename> file which is distributed with Nmap
    and also available from <ulink url="http://www.insecure.org/nmap/changelog.html"/>.</para>

  </refsect1>

  <refsect1 id="man-legal">
    <title>Legal Notices</title>

<refsect2 id="nmap-copyright">
  <title>Nmap Copyright and Licensing</title>

<indexterm significance="normal"><primary>copyright</primary></indexterm>
<indexterm significance="normal"><primary>license</primary></indexterm>
<indexterm significance="normal"><primary>GNU GPL</primary></indexterm>

<para>The Nmap Security
Scanner is (C) 1996-2005 Insecure.Com LLC. Nmap is also a registered
trademark of Insecure.Com LLC.  This program is free software; you may
redistribute and/or modify it under the terms of the GNU General
Public License as published by the Free Software Foundation; Version
2. This guarantees your right to use, modify, and redistribute this
software under certain conditions. If you wish to embed Nmap
technology into proprietary software, we may be willing to sell
alternative licenses (contact <email>sales@insecure.com</email>). Many
security scanner vendors already license Nmap technology such as host
discovery, port scanning, OS detection, and service/version
detection.</para>

<para>Note that the GPL places important restrictions on
<quote>derived works</quote>, yet it does not provide a detailed
definition of that term. To avoid misunderstandings, we consider an
application to constitute a <quote>derivative work</quote> for the
purpose of this license if it does any of the following:</para>

<itemizedlist>
<listitem><para>Integrates source code from Nmap</para></listitem>
<listitem><para>Reads or includes Nmap copyrighted data files, such as
    <filename moreinfo="none">nmap-os-fingerprints</filename> or
    <filename moreinfo="none">nmap-service-probes</filename>.</para></listitem>
<listitem><para>Executes Nmap and parses the results (as opposed to
    typical shell or execution-menu apps, which simply display raw
    Nmap output and so are not derivative works.)</para></listitem>
<listitem><para>Integrates/includes/aggregates Nmap into a proprietary
    executable installer, such as those produced by
    InstallShield.</para></listitem>
<listitem><para>Links to a library or executes a program that does any
    of the above.</para></listitem>
</itemizedlist>

<para>The term <quote>Nmap</quote> should be taken to also include any
portions or derived works of Nmap. This list is not exclusive, but is
just meant to clarify our interpretation of derived works with some
common examples. These restrictions only apply when you actually
redistribute Nmap. For example, nothing stops you from writing and
selling a proprietary front-end to Nmap.  Just distribute it by
itself, and point people to <ulink url="http://www.insecure.org/nmap/"/> to download Nmap.</para>

<para>We don't consider these to be added restrictions on top of the
GPL, but just a clarification of how we interpret <quote>derived
works</quote> as it applies to our GPL-licensed Nmap product.  This is
similar to the way Linus Torvalds has announced his interpretation of
how <quote>derived works</quote> applies to Linux kernel modules. Our
interpretation refers only to Nmap - we don't speak for any other GPL
products.</para>

<para>If you have any questions about the GPL licensing restrictions
on using Nmap in non-GPL works, we would be happy to help. As
mentioned above, we also offer alternative license to integrate Nmap
into proprietary applications and appliances.  These contracts have
been sold to many security vendors, and generally include a perpetual
license as well as providing for priority support and updates as well
as helping to fund the continued development of Nmap
technology. Please email <email>sales@insecure.com</email> for further
information.</para>

<indexterm significance="normal"><primary>license</primary><secondary>OpenSSL exception</secondary></indexterm>

<para>As a special exception to the GPL terms, Insecure.Com LLC grants
permission to link the code of this program with any version of the
OpenSSL library which is distributed under a license identical to that
listed in the included Copying.OpenSSL file, and distribute linked
combinations including the two. You must obey the GNU GPL in all
respects for all of the code used other than OpenSSL. If you modify
this file, you may extend this exception to your version of the file,
but you are not obligated to do so.</para>

<para>If you received these files with a written license agreement or
contract stating terms other than the terms above, then that
alternative license agreement takes precedence over these
comments.</para>
</refsect2>

<refsect2 id="man-copyright">
  <title>Creative Commons license for this Nmap guide</title>
  <para>This Nmap Reference Guide is (C) 2005 Insecure.Com LLC. It is
   hereby placed under version 2.5 of the <ulink url="http://creativecommons.org/licenses/by/2.5/">Creative Commons
   Attribution License</ulink>.  This allows you redistribute and modify
   the work as you desire, as long as you credit the original source.
   Alternatively, you may choose to treat this document as falling under
   the same license as Nmap itself (discussed previously).</para>
</refsect2>

<refsect2 id="source-contrib">
  <title>Source code availability and community contributions</title>

<para>Source is provided to this software because we believe users
have a right to know exactly what a program is going to do before they
run it. This also allows you to audit the software for security holes
(none have been found so far).</para>

<para>Source code also allows you to port Nmap to new platforms, fix
bugs, and add new features. You are highly encouraged to send your
changes to <email>fyodor@insecure.org</email> for possible
incorporation into the main distribution. By sending these changes to
Fyodor or one of the Insecure.Org development mailing lists, it is
assumed that you are offering Fyodor and Insecure.Com LLC the
unlimited, non-exclusive right to reuse, modify, and relicense the
code. Nmap will always be available Open Source, but this is important
because the inability to relicense code has caused devastating
problems for other Free Software projects (such as KDE and NASM). We
also occasionally relicense the code to third parties as discussed
above. If you wish to specify special license conditions of your
contributions, just say so when you send them.</para>
</refsect2>

<refsect2 id="no-warranty"><title>No Warranty</title>

<indexterm significance="normal"><primary>warranty</primary></indexterm>

<para>This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details at <ulink url="http://www.gnu.org/copyleft/gpl.html"/>, or in the COPYING file
included with Nmap.</para>

<para>It should also be noted that Nmap has occasionally been known to crash
poorly written applications, TCP/IP stacks, and even operating
systems.  While this is extremely rare, it is important to keep in
mind.  <emphasis>Nmap should never be run against mission
critical systems</emphasis> unless you are prepared to suffer
downtime. We acknowledge here that Nmap may crash your systems or
networks and we disclaim all liability for any damage or problems Nmap
could cause.</para>
</refsect2>

<refsect2 id="inappropriate-usage"><title>Inappropriate Usage</title>
<para>Because of the slight risk of crashes and because a few black
hats like to use Nmap for reconnaissance prior to attacking systems,
there are administrators who become upset and may complain when their
system is scanned. Thus, it is often advisable to request permission
before doing even a light scan of a network.</para>

<para>Nmap should never be installed with special privileges
(e.g. suid root) for security reasons.</para>
</refsect2>

<refsect2 id="third-party-soft"><title>Third-Party Software</title>
<para>This product includes software developed by the <ulink url="http://www.apache.org">Apache Software Foundation</ulink>.  A
modified version of the <ulink url="http://www.tcpdump.org">Libpcap
portable packet capture library</ulink> is distributed along with
nmap.  The Windows version of Nmap utilized the libpcap-derived <ulink url="http://www.winpcap.org">WinPcap library</ulink> instead.  Regular
expression support is provided by the <ulink url="http://www.pcre.org">PCRE library</ulink>, which is open source
software, written by Philip Hazel.  Certain raw networking functions
use the <ulink url="http://libdnet.sourceforge.net">Libdnet</ulink>
networking library, which was written by Dug Song.  A modified version
is distributed with Nmap.  Nmap can optionally link with the <ulink url="http://www.openssl.org">OpenSSL cryptography toolkit</ulink> for
SSL version detection support.  All of the third-party software
described in this paragraph is freely redistributable under BSD-style
software licenses.</para>
</refsect2>

<refsect2 id="us-export"><title>US Export Control Classification</title>
<indexterm significance="normal"><primary>export controls</primary></indexterm>
<para>US Export Control: Insecure.Com LLC believes that Nmap falls
under US ECCN (export control classification number) 5D992. This
category is called <quote>Information Security software not controlled
by 5D002</quote>. The only restriction of this classification is AT
(anti-terrorism), which applies to almost all goods and denies export
to a handful of rogue nations such as Iran and North Korea. Thus
exporting Nmap does not require any special license, permit, or other
governmental authorization.</para>
</refsect2>

  </refsect1>
</refentry>

</article>
 07070100243fe9000081a40000000a0000000a0000000144fe8f260001f106000000880000000a00000000000000000000001b00000005reloc/doc/nmap/docs/nmap.1    .\" ** You probably do not want to edit this file directly **
.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
.\" Instead of manually editing it, you probably should edit the DocBook XML
.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
.TH "NMAP" "1" "06/23/2006" "" "Nmap Reference Guide"
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.SH "NAME"
nmap \- Network exploration tool and security / port scanner
.SH "SYNOPSIS"
.HP 5
\fBnmap\fR [\fIScan\ Type\fR...] [\fIOptions\fR] {\fItarget\ specification\fR}
.SH "DESCRIPTION"
.PP
Nmap (\(lqNetwork Mapper\(rq) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
.PP
The output from Nmap is a list of scanned targets, with supplemental information on each depending on the options used. Key among that information is the
\(lqinteresting ports table\(rq. That table lists the port number and protocol, service name, and state. The state is either
open,
filtered,
closed, or
unfiltered. Open means that an application on the target machine is listening for connections/packets on that port.
Filtered
means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is
open
or
closed.
Closed
ports have no application listening on them, though they could open up at any time. Ports are classified as
unfiltered
when they are responsive to Nmap's probes, but Nmap cannot determine whether they are open or closed. Nmap reports the state combinations
open|filtered
and
closed|filtered
when it cannot determine which of the two states describe a port. The port table may also include software version details when version detection has been requested. When an IP protocol scan is requested (\fB\-sO\fR), Nmap provides information on supported IP protocols rather than listening ports.
.PP
In addition to the interesting ports table, Nmap can provide further information on targets, including reverse DNS names, operating system guesses, device types, and MAC addresses.
.PP
A typical Nmap scan is shown in
Example\ 13.1, \(lqA representative Nmap scan\(rq. The only Nmap arguments used in this example are
\fB\-A\fR, to enable OS and version detection,
\fB\-T4\fR
for faster execution, and then the two target hostnames.
Example\ 13.1.\ A representative Nmap scan.sp
.nf
# nmap \-A \-T4 scanme.nmap.org playground

Starting nmap ( http://www.insecure.org/nmap/ )
Interesting ports on scanme.nmap.org (205.217.153.62):
(The 1663 ports scanned but not shown below are in state: filtered)
PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 3.9p1 (protocol 1.99)
53/tcp  open   domain
70/tcp  closed gopher
80/tcp  open   http    Apache httpd 2.0.52 ((Fedora))
113/tcp closed auth
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.7 \- 2.6.11, Linux 2.6.0 \- 2.6.11
Uptime 33.908 days (since Thu Jul 21 03:38:03 2005)

Interesting ports on playground.nmap.org (192.168.0.40):
(The 1659 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios\-ssn
389/tcp  open  ldap?
445/tcp  open  microsoft\-ds  Microsoft Windows XP microsoft\-ds
1002/tcp open  windows\-icfw?
1025/tcp open  msrpc         Microsoft Windows RPC
1720/tcp open  H.323/Q.931   CompTek AquaGateKeeper
5800/tcp open  vnc\-http      RealVNC 4.0 (Resolution 400x250; VNC TCP port: 5900)
5900/tcp open  vnc           VNC (protocol 3.8)
MAC Address: 00:A0:CC:63:85:4B (Lite\-on Communications)
Device type: general purpose
Running: Microsoft Windows NT/2K/XP
OS details: Microsoft Windows XP Pro RC1+ through final release
Service Info: OSs: Windows, Windows XP

Nmap finished: 2 IP addresses (2 hosts up) scanned in 88.392 seconds
.fi
.PP
The newest version of Nmap can be obtained from
\fI\%http://www.insecure.org/nmap/\fR. The newest version of the man page is available from
\fI\%http://www.insecure.org/nmap/man/\fR.
.SH "OPTIONS SUMMARY"
.PP
This options summary is printed when Nmap is run with no arguments, and the latest version is always available at
\fI\%http://www.insecure.org/nmap/data/nmap.usage.txt\fR. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual. Some obscure options aren't even included here.
.PP
.nf
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0\-255.1\-254
  \-iL <inputfilename>: Input from list of hosts/networks
  \-iR <num hosts>: Choose random targets
  \-\-exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  \-\-excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  \-sL: List Scan \- simply list targets to scan
  \-sP: Ping Scan \- go no further than determining if host is online
  \-P0: Treat all hosts as online \-\- skip host discovery
  \-PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
  \-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  \-n/\-R: Never do DNS resolution/Always resolve [default: sometimes]
  \-\-dns\-servers <serv1[,serv2],...>: Specify custom DNS servers
  \-\-system\-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
  \-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  \-sN/sF/sX: TCP Null, FIN, and Xmas scans
  \-\-scanflags <flags>: Customize TCP scan flags
  \-sI <zombie host[:probeport]>: Idlescan
  \-sO: IP protocol scan
  \-b <ftp relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  \-p <port ranges>: Only scan specified ports
    Ex: \-p22; \-p1\-65535; \-p U:53,111,137,T:21\-25,80,139,8080
  \-F: Fast \- Scan only the ports listed in the nmap\-services file)
  \-r: Scan ports consecutively \- don't randomize
SERVICE/VERSION DETECTION:
  \-sV: Probe open ports to determine service/version info
  \-\-version\-intensity <level>: Set from 0 (light) to 9 (try all probes)
  \-\-version\-light: Limit to most likely probes (intensity 2)
  \-\-version\-all: Try every single probe (intensity 9)
  \-\-version\-trace: Show detailed version scan activity (for debugging)
OS DETECTION:
  \-O: Enable OS detection
  \-\-osscan\-limit: Limit OS detection to promising targets
  \-\-osscan\-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in milliseconds, unless you append 's'
  (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  \-T[0\-5]: Set timing template (higher is faster)
  \-\-min\-hostgroup/max\-hostgroup <size>: Parallel host scan group sizes
  \-\-min\-parallelism/max\-parallelism <time>: Probe parallelization
  \-\-min\-rtt\-timeout/max\-rtt\-timeout/initial\-rtt\-timeout <time>: Specifies
      probe round trip time.
  \-\-max\-retries <tries>: Caps number of port scan probe retransmissions.
  \-\-host\-timeout <time>: Give up on target after this long
  \-\-scan\-delay/\-\-max\-scan\-delay <time>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
  \-f; \-\-mtu <val>: fragment packets (optionally w/given MTU)
  \-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  \-S <IP_Address>: Spoof source address
  \-e <iface>: Use specified interface
  \-g/\-\-source\-port <portnum>: Use given port number
  \-\-data\-length <num>: Append random data to sent packets
  \-\-ttl <val>: Set IP time\-to\-live field
  \-\-spoof\-mac <mac address/prefix/vendor name>: Spoof your MAC address
  \-\-badsum: Send packets with a bogus TCP/UDP checksum
OUTPUT:
  \-oN/\-oX/\-oS/\-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  \-oA <basename>: Output in the three major formats at once
  \-v: Increase verbosity level (use twice for more effect)
  \-d[level]: Set or increase debugging level (Up to 9 is meaningful)
  \-\-packet\-trace: Show all packets sent and received
  \-\-iflist: Print host interfaces and routes (for debugging)
  \-\-log\-errors: Log errors/warnings to the normal\-format output file
  \-\-append\-output: Append to rather than clobber specified output files
  \-\-resume <filename>: Resume an aborted scan
  \-\-stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  \-\-webxml: Reference stylesheet from Insecure.Org for more portable XML
  \-\-no\-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  \-6: Enable IPv6 scanning
  \-A: Enables OS detection and Version detection
  \-\-datadir <dirname>: Specify custom Nmap data file location
  \-\-send\-eth/\-\-send\-ip: Send using raw ethernet frames or IP packets
  \-\-privileged: Assume that the user is fully privileged
  \-V: Print version number
  \-h: Print this help summary page.
EXAMPLES:
  nmap \-v \-A scanme.nmap.org
  nmap \-v \-sP 192.168.0.0/16 10.0.0.0/8
  nmap \-v \-iR 10000 \-P0 \-p 80
.fi
.sp
.SH "TARGET SPECIFICATION"
.PP
Everything on the Nmap command\-line that isn't an option (or option argument) is treated as a target host specification. The simplest case is to specify a target IP address or hostname for scanning.
.PP
Sometimes you wish to scan a whole network of adjacent hosts. For this, Nmap supports CIDR\-style addressing. You can append

/\fInumbits\fR
to an IP address or hostname and Nmap will scan every IP address for which the first
\fInumbits\fR
are the same as for the reference IP or hostname given. For example, 192.168.10.0/24 would scan the 256 hosts between 192.168.10.0 (binary:
11000000 10101000 00001010 00000000) and 192.168.10.255 (binary:
11000000 10101000 00001010 11111111), inclusive. 192.168.10.40/24 would do exactly the same thing. Given that the host scanme.nmap.org is at the IP address 205.217.153.62, the specification scanme.nmap.org/16 would scan the 65,536 IP addresses between 205.217.0.0 and 205.217.255.255. The smallest allowed value is /1, which scans half the Internet. The largest value is 32, which scans just the named host or IP address because all address bits are fixed.
.PP
CIDR notation is short but not always flexible enough. For example, you might want to scan 192.168.0.0/16 but skip any IPs ending with .0 or .255 because they are commonly broadcast addresses. Nmap supports this through octet range addressing. Rather than specify a normal IP address, you can specify a comma separated list of numbers or ranges for each octet. For example, 192.168.0\-255.1\-254 will skip all addresses in the range that end in .0 and or .255. Ranges need not be limited to the final octects: the specifier 0\-255.0\-255.13.37 will perform an Internet\-wide scan for all IP addresses ending in 13.37. This sort of broad sampling can be useful for Internet surveys and research.
.PP
IPv6 addresses can only be specified by their fully qualified IPv6 address or hostname. CIDR and octet ranges aren't supported for IPv6 because they are rarely useful.
.PP
Nmap accepts multiple host specifications on the command line, and they don't need to be the same type. The command
\fBnmap scanme.nmap.org 192.168.0.0/16 10.0.0,1,3\-7.0\-255\fR
does what you would expect.
.PP
While targets are usually specified on the command lines, the following options are also available to control target selection:
.TP
\fB\-iL <inputfilename>\fR (Input from list)
Reads target specifications from
\fIinputfilename\fR. Passing a huge list of hosts is often awkward on the command line, yet it is a common desire. For example, your DHCP server might export a list of 10,000 current leases that you wish to scan. Or maybe you want to scan all IP addresses
\fIexcept\fR
for those to locate hosts using unauthorized static IP addresses. Simply generate the list of hosts to scan and pass that filename to Nmap as an argument to the
\fB\-iL\fR
option. Entries can be in any of the formats accepted by Nmap on the command line (IP address, hostname, CIDR, IPv6, or octet ranges). Each entry must be separated by one or more spaces, tabs, or newlines. You can specify a hyphen (\-) as the filename if you want Nmap to read hosts from standard input rather than an actual file.
.TP
\fB\-iR <num hosts>\fR (Choose random targets)
For Internet\-wide surveys and other research, you may want to choose targets at random. The
\fInum hosts\fR
argument tells Nmap how many IPs to generate. Undesirable IPs such as those in certain private, multicast, or unallocated address ranges are automatically skipped. The argument
0
can be specified for a never\-ending scan. Keep in mind that some network administrators bristle at unauthorized scans of their networks and may complain. Use this option at your own risk! If you find yourself really bored one rainy afternoon, try the command
\fBnmap \-sS \-PS80 \-iR 0 \-p 80\fR
to locate random web servers for browsing.
.TP
\fB\-\-exclude <host1[,host2][,host3],...>\fR (Exclude hosts/networks)
Specifies a comma\-separated list of targets to be excluded from the scan even if they are part of the overall network range you specify. The list you pass in uses normal Nmap syntax, so it can include hostnames, CIDR netblocks, octet ranges, etc. This can be useful when the network you wish to scan includes untouchable mission\-critical servers, systems that are known to react adversely to port scans, or subnetworks administered by other people.
.TP
\fB\-\-excludefile <exclude_file>\fR (Exclude list from file)
This offers the same functionality as the
\fB\-\-exclude\fR
option, except that the excluded targets are provided in a newline, space, or tab delimited
\fIexclude_file\fR
rather than on the command line.
.SH "HOST DISCOVERY"
.PP
One of the very first steps in any network reconnaissance mission is to reduce a (sometimes huge) set of IP ranges into a list of active or interesting hosts. Scanning every port of every single IP address is slow and usually unnecessary. Of course what makes a host interesting depends greatly on the scan purposes. Network administrators may only be interested in hosts running a certain service, while security auditors may care about every single device with an IP address. An administrator may be comfortable using just an ICMP ping to locate hosts on his internal network, while an external penetration tester may use a diverse set of dozens of probes in an attempt to evade firewall restrictions.
.PP
Because host discovery needs are so diverse, Nmap offers a wide variety of options for customizing the techniques used. Host discovery is sometimes called ping scan, but it goes well beyond the simple ICMP echo request packets associated with the ubiquitous
ping
tool. Users can skip the ping step entirely with a list scan (\fB\-sL\fR) or by disabling ping (\fB\-P0\fR), or engage the network with arbitrary combinations of multi\-port TCP SYN/ACK, UDP, and ICMP probes. The goal of these probes is to solicit responses which demonstrate that an IP address is actually active (is being used by a host or network device). On many networks, only a small percentage of IP addresses are active at any given time. This is particularly common with RFC1918\-blessed private address space such as 10.0.0.0/8. That network has 16 million IPs, but I have seen it used by companies with less than a thousand machines. Host discovery can find those machines in a sparsely allocated sea of IP addresses.
.PP
If no host discovery options are given, Nmap sends a TCP ACK packet destined for port 80 and an ICMP Echo Request query to each target machine. An exception to this is that an ARP scan is used for any targets which are on a local ethernet network. For unprivileged UNIX shell users, a SYN packet is sent instead of the ack using the
\fBconnect()\fR
system call. These defaults are equivalent to the
\fB\-PA \-PE\fR
options. This host discovery is often sufficient when scanning local networks, but a more comprehensive set of discovery probes is recommended for security auditing.
.PP
The
\fB\-P*\fR
options (which select ping types) can be combined. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes. Also note that ARP discovery (\fB\-PR\fR) is done by default against targets on a local ethernet network even if you specify other
\fB\-P*\fR
options, because it is almost always faster and more effective.
.PP
By default, Nmap does host discovery and then performs a port scan against each host it determines is online. This is true even if you specify non\-default host discovery types such as UDP probes (\fB\-PU\fR). Read about the
\fB\-sP\fR
option to learn how to perform
\fIonly\fR
host discovery, or use
\fB\-P0\fR
to skip host discovery and port scan all target hosts. The following options control host discovery:
.TP
\fB\-sL\fR (List Scan)
The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse\-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example,
fw.chi.playboy.com
is the firewall for the Chicago office of Playboy Enterprises. Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company's network.
.sp
Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the
\fB\-P0\fR
option.
.TP
\fB\-sP\fR (Ping Scan)
This option tells Nmap to
\fIonly\fR
perform a ping scan (host discovery), then print out the available hosts that responded to the scan. No further testing (such as port scanning or OS detection) is performed. This is one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.
.sp
Systems administrators often find this option valuable as well. It can easily be used to count available machines on a network or monitor server availability. This is often called a ping sweep, and is more reliable than pinging the broadcast address because many hosts do not reply to broadcast queries.
.sp
The
\fB\-sP\fR
option sends an ICMP echo request and a TCP packet to port 80 by default. When executed by an unprivileged user, a SYN packet is sent (using a
\fBconnect()\fR
call) to port 80 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests (\fB\-PR\fR) are used unless
\fB\-\-send\-ip\fR
was specified. The
\fB\-sP\fR
option can be combined with any of the discovery probe types (the
\fB\-P*\fR
options, excluding
\fB\-P0\fR) for greater flexibility. If any of those probe type and port number options are used, the default probes (ACK and echo request) are overridden. When strict firewalls are in place between the source host running Nmap and the target network, using those advanced techniques is recommended. Otherwise hosts could be missed when the firewall drops probes or their responses.
.TP
\fB\-P0\fR (No ping)
This option skips the Nmap discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning. By default, Nmap only performs heavy probing such as port scans, version detection, or OS detection against hosts that are found to be up. Disabling host discovery with
\fB\-P0\fR
causes Nmap to attempt the requested scanning functions against
\fIevery\fR
target IP address specified. So if a class B sized target address space (/16) is specified on the command line, all 65,536 IP addresses are scanned. That second option character in
\fB\-P0\fR
is a zero and not the letter O. Proper host discovery is skipped as with the list scan, but instead of stopping and printing the target list, Nmap continues to perform requested functions as if each target IP is active.
.TP
\fB\-PS [portlist]\fR (TCP SYN Ping)
This option sends an empty TCP packet with the SYN flag set. The default destination port is 80 (configurable at compile time by changing DEFAULT_TCP_PROBE_PORT in
\fInmap.h\fR), but an alternate port can be specified as a parameter. A comma separated list of ports can even be specified (e.g.
\fB\-PS22,23,25,80,113,1050,35000\fR), in which case probes will be attempted against each port in parallel.
.sp
The SYN flag suggests to the remote system that you are attempting to establish a connection. Normally the destination port will be closed, and a RST (reset) packet sent back. If the port happens to be open, the target will take the second step of a TCP 3\-way\-handshake by responding with a SYN/ACK TCP packet. The machine running Nmap then tears down the nascent connection by responding with a RST rather than sending an ACK packet which would complete the 3\-way\-handshake and establish a full connection. The RST packet is sent by the kernel of the machine running Nmap in response to the unexpected SYN/ACK, not by Nmap itself.
.sp
Nmap does not care whether the port is open or closed. Either the RST or SYN/ACK response discussed previously tell Nmap that the host is available and responsive.
.sp
On UNIX boxes, only the privileged user
root
is generally able to send and receive raw TCP packets. For unprivileged users, a workaround is automatically employed whereby the connect() system call is initiated against each target port. This has the effect of sending a SYN packet to the target host, in an attempt to establish a connection. If connect() returns with a quick success or an ECONNREFUSED failure, the underlying TCP stack must have received a SYN/ACK or RST and the host is marked available. If the connection attempt is left hanging until a timeout is reached, the host is marked as down. This workaround is also used for IPv6 connections, as raw IPv6 packet building support is not yet available in Nmap.
.TP
\fB\-PA [portlist]\fR (TCP ACK Ping)
The TCP ACK ping is quite similar to the just\-discussed SYN ping. The difference, as you could likely guess, is that the TCP ACK flag is set instead of the SYN flag. Such an ACK packet purports to be acknowledging data over an established TCP connection, but no such connection exists. So remote hosts should always respond with a RST packet, disclosing their existence in the process.
.sp
The
\fB\-PA\fR
option uses the same default port as the SYN probe (80) and can also take a list of destination ports in the same format. If an unprivileged user tries this, or an IPv6 target is specified, the connect() workaround discussed previously is used. This workaround is imperfect because connect() is actually sending a SYN packet rather than an ACK.
.sp
The reason for offering both SYN and ACK ping probes is to maximize the chances of bypassing firewalls. Many administrators configure routers and other simple firewalls to block incoming SYN packets except for those destined for public services like the company web site or mail server. This prevents other incoming connections to the organization, while allowing users to make unobstructed outgoing connections to the Internet. This non\-stateful approach takes up few resources on the firewall/router and is widely supported by hardware and software filters. The Linux Netfilter/iptables firewall software offers the
\fB\-\-syn\fR
convenience option to implement this stateless approach. When stateless firewall rules such as this are in place, SYN ping probes (\fB\-PS\fR) are likely to be blocked when sent to closed target ports. In such cases, the ACK probe shines as it cuts right through these rules.
.sp
Another common type of firewall uses stateful rules that drop unexpected packets. This feature was initially found mostly on high\-end firewalls, though it has become much more common over the years. The Linux Netfilter/iptables system supports this through the
\fB\-\-state\fR
option, which categorizes packets based on connection state. A SYN probe is more likely to work against such a system, as unexpected ACK packets are generally recognized as bogus and dropped. A solution to this quandary is to send both SYN and ACK probes by specifying
\fB\-PS\fR
and
\fB\-PA\fR.
.TP
\fB\-PU [portlist]\fR (UDP Ping)
Another host discovery option is the UDP ping, which sends an empty (unless
\fB\-\-data\-length\fR
is specified) UDP packet to the given ports. The portlist takes the same format as with the previously discussed
\fB\-PS\fR
and
\fB\-PA\fR
options. If no ports are specified, the default is 31338. This default can be configured at compile\-time by changing DEFAULT_UDP_PROBE_PORT in
\fInmap.h\fR. A highly uncommon port is used by default because sending to open ports is often undesirable for this particular scan type.
.sp
Upon hitting a closed port on the target machine, the UDP probe should elicit an ICMP port unreachable packet in return. This signifies to Nmap that the machine is up and available. Many other types of ICMP errors, such as host/network unreachables or TTL exceeded are indicative of a down or unreachable host. A lack of response is also interpreted this way. If an open port is reached, most services simply ignore the empty packet and fail to return any response. This is why the default probe port is 31338, which is highly unlikely to be in use. A few services, such as chargen, will respond to an empty UDP packet, and thus disclose to Nmap that the machine is available.
.sp
The primary advantage of this scan type is that it bypasses firewalls and filters that only screen TCP. For example, I once owned a Linksys BEFW11S4 wireless broadband router. The external interface of this device filtered all TCP ports by default, but UDP probes would still elicit port unreachable messages and thus give away the device.
.TP
\fB\-PE\fR; \fB\-PP\fR; \fB\-PM\fR (ICMP Ping Types)
In addition to the unusual TCP and UDP host discovery types discussed previously, Nmap can send the standard packets sent by the ubiquitous
ping
program. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (Echo Reply) in return from available hosts. Unfortunately for network explorers, many hosts and firewalls now block these packets, rather than responding as required by
[1]\&\fIRFC 1122\fR. For this reason, ICMP\-only scans are rarely reliable enough against unknown targets over the Internet. But for system administrators monitoring an internal network, they can be a practical and efficient approach. Use the
\fB\-PE\fR
option to enable this echo request behavior.
.sp
While echo request is the standard ICMP ping query, Nmap does not stop there. The ICMP standard ([2]\&\fIRFC 792\fR) also specifies timestamp request, information request, and address mask request packets as codes 13, 15, and 17, respectively. While the ostensible purpose for these queries is to learn information such as address masks and current times, they can easily be used for host discovery. A system that replies is up and available. Nmap does not currently implement information request packets, as they are not widely supported. RFC 1122 insists that
\(lqa host SHOULD NOT implement these messages\(rq. Timestamp and address mask queries can be sent with the
\fB\-PP\fR
and
\fB\-PM\fR
options, respectively. A timestamp reply (ICMP code 14) or address mask reply (code 18) discloses that the host is available. These two queries can be valuable when admins specifically block echo request packets while forgetting that other ICMP queries can be used for the same purpose.
.TP
\fB\-PR\fR (ARP Ping)
One of the most common Nmap usage scenarios is to scan an ethernet LAN. On most LANs, especially those using RFC1918\-blessed private address ranges, the vast majority of IP addresses are unused at any given time. When Nmap tries to send a raw IP packet such as an ICMP echo request, the operating system must determine the destination hardware (ARP) address corresponding to the target IP so that it can properly address the ethernet frame. This is often slow and problematic, since operating systems weren't written with the expectation that they would need to do millions of ARP requests against unavailable hosts in a short time period.
.sp
ARP scan puts Nmap and its optimized algorithms in charge of ARP requests. And if it gets a response back, Nmap doesn't even need to worry about the IP\-based ping packets since it already knows the host is up. This makes ARP scan much faster and more reliable than IP\-based scans. So it is done by default when scanning ethernet hosts that Nmap detects are on a local ethernet network. Even if different ping types (such as
\fB\-PE\fR
or
\fB\-PS\fR) are specified, Nmap uses ARP instead for any of the targets which are on the same LAN. If you absolutely don't want to do an ARP scan, specify
\fB\-\-send\-ip\fR.
.TP
\fB\-n\fR (No DNS resolution)
Tells Nmap to
\fInever\fR
do reverse DNS resolution on the active IP addresses it finds. Since DNS is often slow, this speeds things up.
.TP
\fB\-R\fR (DNS resolution for all targets)
Tells Nmap to
\fIalways\fR
do reverse DNS resolution on the target IP addresses. Normally this is only performed when a machine is found to be alive.
.TP
\fB\-\-system\-dns\fR (Use system DNS resolver)
By default, Nmap resolves IP addresses by sending queries directly to the name servers configured on your host and then listening for responses. Many requests (often dozens) are performed in parallel for performance. Specify this option if you wish to use your system resolver instead (one IP at a time via the getnameinfo() call). This is slower and rarely useful unless there is a bug in the Nmap DNS code \-\- please contact us if that is the case. The system resolver is always used for IPv6 scans.
.TP
\fB\-\-dns\-servers <server1[,server2],...> \fR (Servers to use for reverse DNS queries)
By default Nmap will try to determine your DNS servers (for rDNS resolution) from your resolv.conf file (UNIX) or the registry (Win32). Alternatively, you may use this option to specify alternate servers. This option is not honored if you are using
\fB\-\-system\-dns\fR
or an IPv6 scan. Using multiple DNS servers is often faster and more stealthy than querying just one. The best performance is often obtained by specifying all of the authoritative servers for the target IP space.
.SH "PORT SCANNING BASICS"
.PP
While Nmap has grown in functionality over the years, it began as an efficient port scanner, and that remains its core function. The simple command
\fBnmap \fR\fB\fItarget\fR\fR
scans more than 1660 TCP ports on the host
\fItarget\fR. While many port scanners have traditionally lumped all ports into the open or closed states, Nmap is much more granular. It divides ports into six states:
open,
closed,
filtered,
unfiltered,
open|filtered, or
closed|filtered.
.PP
These states are not intrinsic properties of the port itself, but describe how Nmap sees them. For example, an Nmap scan from the same network as the target may show port 135/tcp as open, while a scan at the same time with the same options from across the Internet might show that port as
filtered.
.PP
\fBThe six port states recognized by Nmap\fR
.TP
open
An application is actively accepting TCP connections or UDP packets on this port. Finding these is often the primary goal of port scanning. Security\-minded people know that each open port is an avenue for attack. Attackers and pen\-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non\-security scans because they show services available for use on the network.
.TP
closed
A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.
.TP
filtered
Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host\-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.
.TP
unfiltered
The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open.
.TP
open|filtered
Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP Protocol, FIN, Null, and Xmas scans classify ports this way.
.TP
closed|filtered
This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IPID Idle scan.
.SH "PORT SCANNING TECHNIQUES"
.PP
As a novice performing automotive repair, I can struggle for hours trying to fit my rudimentary tools (hammer, duct tape, wrench, etc.) to the task at hand. When I fail miserably and tow my jalopy to a real mechanic, he invariably fishes around in a huge tool chest until pulling out the perfect gizmo which makes the job seem effortless. The art of port scanning is similar. Experts understand the dozens of scan techniques and choose the appropriate one (or combination) for a given task. Inexperienced users and script kiddies, on the other hand, try to solve every problem with the default SYN scan. Since Nmap is free, the only barrier to port scanning mastery is knowledge. That certainly beats the automotive world, where it may take great skill to determine that you need a strut spring compressor, then you still have to pay thousands of dollars for it.
.PP
Most of the scan types are only available to privileged users. This is because they send and receive raw packets, which requires root access on UNIX systems. Using an administrator account on Windows is recommended, though Nmap sometimes works for unprivileged users on that platform when WinPcap has already been loaded into the OS. Requiring root privileges was a serious limitation when Nmap was released in 1997, as many users only had access to shared shell accounts. Now, the world is different. Computers are cheaper, far more people have always\-on direct Internet access, and desktop UNIX systems (including Linux and MAC OS X) are prevalent. A Windows version of Nmap is now available, allowing it to run on even more desktops. For all these reasons, users have less need to run Nmap from limited shared shell accounts. This is fortunate, as the privileged options make Nmap far more powerful and flexible.
.PP
While Nmap attempts to produce accurate results, keep in mind that all of its insights are based on packets returned by the target machines (or firewalls in front of them). Such hosts may be untrustworthy and send responses intended to confuse or mislead Nmap. Much more common are non\-RFC\-compliant hosts that do not respond as they should to Nmap probes. FIN, Null, and Xmas scans are particularly susceptible to this problem. Such issues are specific to certain scan types and so are discussed in the individual scan type entries.
.PP
This section documents the dozen or so port scan techniques supported by Nmap. Only one method may be used at a time, except that UDP scan (\fB\-sU\fR) may be combined with any one of the TCP scan types. As a memory aid, port scan type options are of the form
\fB\-s\fR\fB\fIC\fR\fR, where
\fIC\fR
is a prominent character in the scan name, usually the first. The one exception to this is the deprecated FTP bounce scan (\fB\-b\fR). By default, Nmap performs a SYN Scan, though it substitutes a connect scan if the user does not have proper privileges to send raw packets (requires root access on UNIX) or if IPv6 targets were specified. Of the scans listed in this section, unprivileged users can only execute connect and ftp bounce scans.
.TP
\fB\-sS\fR (TCP SYN scan)
SYN scan is the default and most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by intrusive firewalls. SYN scan is relatively unobtrusive and stealthy, since it never completes TCP connections. It also works against any compliant TCP stack rather than depending on idiosyncrasies of specific platforms as Nmap's Fin/Null/Xmas, Maimon and Idle scans do. It also allows clear, reliable differentiation between the
open,
closed, and
filtered
states.
.sp
This technique is often referred to as half\-open scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and then wait for a response. A SYN/ACK indicates the port is listening (open), while a RST (reset) is indicative of a non\-listener. If no response is received after several retransmissions, the port is marked as filtered. The port is also marked filtered if an ICMP unreachable error (type 3, code 1,2, 3, 9, 10, or 13) is received.
.TP
\fB\-sT\fR (TCP connect scan)
TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges or is scanning IPv6 networks. Instead of writing raw packets as most other scan types do, Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the
connect()
system call. This is the same high\-level system call that web browsers, P2P clients, and most other network\-enabled applications use to establish a connection. It is part of a programming interface known as the Berkeley Sockets API. Rather than read raw packet responses off the wire, Nmap uses this API to obtain status information on each connection attempt.
.sp
When SYN scan is available, it is usually a better choice. Nmap has less control over the high level
connect()
call than with raw packets, making it less efficient. The system call completes connections to open target ports rather than performing the half\-open reset that SYN scan does. Not only does this take longer and require more packets to obtain the same information, but target machines are more likely to log the connection. A decent IDS will catch either, but most machines have no such alarm system. Many services on your average UNIX system will add a note to syslog, and sometimes a cryptic error message, when Nmap connects and then closes the connection without sending data. Truly pathetic services crash when this happens, though that is uncommon. An administrator who sees a bunch of connection attempts in her logs from a single system should know that she has been connect scanned.
.TP
\fB\-sU\fR (UDP scans)
While most popular services on the Internet run over the TCP protocol,
[3]\&\fIUDP\fR
services are widely deployed. DNS, SNMP, and DHCP (registered ports 53, 161/162, and 67/68) are three of the most common. Because UDP scanning is generally slower and more difficult than TCP, some security auditors ignore these ports. This is a mistake, as exploitable UDP services are quite common and attackers certainly don't ignore the whole protocol. Fortunately, Nmap can help inventory UDP ports.
.sp
UDP scan is activated with the
\fB\-sU\fR
option. It can be combined with a TCP scan type such as SYN scan (\fB\-sS\fR) to check both protocols during the same run.
.sp
UDP scan works by sending an empty (no data) UDP header to every targeted port. If an ICMP port unreachable error (type 3, code 3) is returned, the port is
closed. Other ICMP unreachable errors (type 3, codes 1, 2, 9, 10, or 13) mark the port as
filtered. Occasionally, a service will respond with a UDP packet, proving that it is
open. If no response is received after retransmissions, the port is classified as
open|filtered. This means that the port could be open, or perhaps packet filters are blocking the communication. Versions scan (\fB\-sV\fR) can be used to help differentiate the truly open ports from the filtered ones.
.sp
A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost. Closed ports are often an even bigger problem. They usually send back an ICMP port unreachable error. But unlike the RST packets sent by closed TCP ports in response to a SYN or connect scan, many hosts rate limit ICMP port unreachable messages by default. Linux and Solaris are particularly strict about this. For example, the Linux 2.4.20 kernel limits destination unreachable messages to one per second (in
\fInet/ipv4/icmp.c\fR).
.sp
Nmap detects rate limiting and slows down accordingly to avoid flooding the network with useless packets that the target machine will drop. Unfortunately, a Linux\-style limit of one packet per second makes a 65,536\-port scan take more than 18 hours. Ideas for speeding your UDP scans up include scanning more hosts in parallel, doing a quick scan of just the popular ports first, scanning from behind the firewall, and using
\fB\-\-host\-timeout\fR
to skip slow hosts.
.TP
\fB\-sN\fR; \fB\-sF\fR; \fB\-sX\fR (TCP Null, FIN, and Xmas scans)
These three scan types (even more are possible with the
\fB\-\-scanflags\fR
option described in the next section) exploit a subtle loophole in the
[4]\&\fITCP RFC\fR
to differentiate between
open
and
closed
ports. Page 65 says that
\(lqif the [destination] port state is CLOSED .... an incoming segment not containing a RST causes a RST to be sent in response.\(rq
Then the next page discusses packets sent to open ports without the SYN, RST, or ACK bits set, stating that:
\(lqyou are unlikely to get here, but if you do, drop the segment, and return.\(rq
.sp
When scanning systems compliant with this RFC text, any packet not containing SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response at all if the port is open. As long as none of those three bits are included, any combination of the other three (FIN, PSH, and URG) are OK. Nmap exploits this with three scan types:
.RS
.TP
Null scan (\fB\-sN\fR)
Does not set any bits (tcp flag header is 0)
.TP
FIN scan (\fB\-sF\fR)
Sets just the TCP FIN bit.
.TP
Xmas scan (\fB\-sX\fR)
Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.
.RE
.IP
These three scan types are exactly the same in behavior except for the TCP flags set in probe packets. If a RST packet is received, the port is considered
closed, while no response means it is
open|filtered. The port is marked
filtered
if an ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13) is received.
.sp
The key advantage to these scan types is that they can sneak through certain non\-stateful firewalls and packet filtering routers. Another advantage is that these scan types are a little more stealthy than even a SYN scan. Don't count on this though \-\- most modern IDS products can be configured to detect them. The big downside is that not all systems follow RFC 793 to the letter. A number of systems send RST responses to the probes regardless of whether the port is open or not. This causes all of the ports to be labeled
closed. Major operating systems that do this are Microsoft Windows, many Cisco devices, BSDI, and IBM OS/400. This scan does work against most UNIX\-based systems though. Another downside of these scans is that they can't distinguish
open
ports from certain
filtered
ones, leaving you with the response
open|filtered.
.TP
\fB\-sA\fR (TCP ACK scan)
This scan is different than the others discussed so far in that it never determines
open
(or even
open|filtered) ports. It is used to map out firewall rulesets, determining whether they are stateful or not and which ports are filtered.
.sp
The ACK scan probe packet has only the ACK flag set (unless you use
\fB\-\-scanflags\fR). When scanning unfiltered systems,
open
and
closed
ports will both return a RST packet. Nmap then labels them as
unfiltered, meaning that they are reachable by the ACK packet, but whether they are
open
or
closed
is undetermined. Ports that don't respond, or send certain ICMP error messages back (type 3, code 1, 2, 3, 9, 10, or 13), are labeled
filtered.
.TP
\fB\-sW\fR (TCP Window scan)
Window scan is exactly the same as ACK scan except that it exploits an implementation detail of certain systems to differentiate open ports from closed ones, rather than always printing
unfiltered
when a RST is returned. It does this by examining the TCP Window field of the RST packets returned. On some systems, open ports use a positive window size (even for RST packets) while closed ones have a zero window. So instead of always listing a port as
unfiltered
when it receives a RST back, Window scan lists the port as
open
or
closed
if the TCP Window value in that reset is positive or zero, respectively.
.sp
This scan relies on an implementation detail of a minority of systems out on the Internet, so you can't always trust it. Systems that don't support it will usually return all ports
closed. Of course, it is possible that the machine really has no open ports. If most scanned ports are
closed
but a few common port numbers (such as 22, 25, 53) are
filtered, the system is most likely susceptible. Occasionally, systems will even show the exact opposite behavior. If your scan shows 1000 open ports and 3 closed or filtered ports, then those three may very well be the truly open ones.
.TP
\fB\-sM\fR (TCP Maimon scan)
The Maimon scan is named after its discoverer, Uriel Maimon. He described the technique in Phrack Magazine issue #49 (November 1996). Nmap, which included this technique, was released two issues later. This technique is exactly the same as Null, FIN, and Xmas scans, except that the probe is FIN/ACK. According to RFC 793 (TCP), a RST packet should be generated in response to such a probe whether the port is open or closed. However, Uriel noticed that many BSD\-derived systems simply drop the packet if the port is open.
.TP
\fB\-\-scanflags\fR (Custom TCP scan)
Truly advanced Nmap users need not limit themselves to the canned scan types offered. The
\fB\-\-scanflags\fR
option allows you to design your own scan by specifying arbitrary TCP flags. Let your creative juices flow, while evading intrusion detection systems whose vendors simply paged through the Nmap man page adding specific rules!
.sp
The
\fB\-\-scanflags\fR
argument can be a numerical flag value such as 9 (PSH and FIN), but using symbolic names is easier. Just mash together any combination of
URG,
ACK,
PSH,
RST,
SYN, and
FIN. For example,
\fB\-\-scanflags URGACKPSHRSTSYNFIN\fR
sets everything, though it's not very useful for scanning. The order these are specified in is irrelevant.
.sp
In addition to specifying the desired flags, you can specify a TCP scan type (such as
\fB\-sA\fR
or
\fB\-sF\fR). That base type tells Nmap how to interpret responses. For example, a SYN scan considers no\-response to indicate a
filtered
port, while a FIN scan treats the same as
open|filtered. Nmap will behave the same way it does for the base scan type, except that it will use the TCP flags you specify instead. If you don't specify a base type, SYN scan is used.
.TP
\fB\-sI <zombie host[:probeport]>\fR (Idlescan)
This advanced scan method allows for a truly blind TCP port scan of the target (meaning no packets are sent to the target from your real IP address). Instead, a unique side\-channel attack exploits predictable IP fragmentation ID sequence generation on the zombie host to glean information about the open ports on the target. IDS systems will display the scan as coming from the zombie machine you specify (which must be up and meet certain criteria). This fascinating scan type is too complex to fully describe in this reference guide, so I wrote and posted an informal paper with full details at
\fI\%http://www.insecure.org/nmap/idlescan.html\fR.
.sp
Besides being extraordinarily stealthy (due to its blind nature), this scan type permits mapping out IP\-based trust relationships between machines. The port listing shows open ports
\fIfrom the perspective of the zombie host.\fR
So you can try scanning a target using various zombies that you think might be trusted (via router/packet filter rules).
.sp
You can add a colon followed by a port number to the zombie host if you wish to probe a particular port on the zombie for IPID changes. Otherwise Nmap will use the port it uses by default for tcp pings (80).
.TP
\fB\-sO\fR (IP protocol scan)
IP Protocol scan allows you to determine which IP protocols (TCP, ICMP, IGMP, etc.) are supported by target machines. This isn't technically a port scan, since it cycles through IP protocol numbers rather than TCP or UDP port numbers. Yet it still uses the
\fB\-p\fR
option to select scanned protocol numbers, reports its results within the normal port table format, and even uses the same underlying scan engine as the true port scanning methods. So it is close enough to a port scan that it belongs here.
.sp
Besides being useful in its own right, protocol scan demonstrates the power of open source software. While the fundamental idea is pretty simple, I had not thought to add it nor received any requests for such functionality. Then in the summer of 2000, Gerhard Rieger conceived the idea, wrote an excellent patch implementing it, and sent it to the nmap\-hackers mailing list. I incorporated that patch into the Nmap tree and released a new version the next day. Few pieces of commercial software have users enthusiastic enough to design and contribute their own improvements!
.sp
Protocol scan works in a similar fashion to UDP scan. Instead of iterating through the port number field of a UDP packet, it sends IP packet headers and iterates through the 8\-bit IP protocol field. The headers are usually empty, containing no data and not even the proper header for the claimed protocol. The three exceptions are TCP, UDP, and ICMP. A proper protocol header for those is included since some systems won't send them otherwise and because Nmap already has functions to create them. Instead of watching for ICMP port unreachable messages, protocol scan is on the lookout for ICMP
\fIprotocol\fR
unreachable messages. If Nmap receives any response in any protocol from the target host, Nmap marks that protocol as
open. An ICMP protocol unreachable error (type 3, code 2) causes the protocol to be marked as
closed
Other ICMP unreachable errors (type 3, code 1, 3, 9, 10, or 13) cause the protocol to be marked
filtered
(though they prove that ICMP is
open
at the same time). If no response is received after retransmissions, the protocol is marked
open|filtered
.TP
\fB\-b <ftp relay host>\fR (FTP bounce scan)
An interesting feature of the FTP protocol ([5]\&\fIRFC 959\fR) is support for so\-called proxy ftp connections. This allows a user to connect to one FTP server, then ask that files be sent to a third\-party server. Such a feature is ripe for abuse on many levels, so most servers have ceased supporting it. One of the abuses this feature allows is causing the FTP server to port scan other hosts. Simply ask the FTP server to send a file to each interesting port of a target host in turn. The error message will describe whether the port is open or not. This is a good way to bypass firewalls because organizational FTP servers are often placed where they have more access to other internal hosts than any old Internet host would. Nmap supports ftp bounce scan with the
\fB\-b\fR
option. It takes an argument of the form
\fIusername\fR:\fIpassword\fR@\fIserver\fR:\fIport\fR.
\fIServer\fR
is the name or IP address of a vulnerable FTP server. As with a normal URL, you may omit
\fIusername\fR:\fIpassword\fR, in which case anonymous login credentials (user:
anonymous
password:\-wwwuser@) are used. The port number (and preceding colon) may be omitted as well, in which case the default FTP port (21) on
\fIserver\fR
is used.
.sp
This vulnerability was widespread in 1997 when Nmap was released, but has largely been fixed. Vulnerable servers are still around, so it is worth trying when all else fails. If bypassing a firewall is your goal, scan the target network for open port 21 (or even for any ftp services if you scan all ports with version detection), then try a bounce scan using each. Nmap will tell you whether the host is vulnerable or not. If you are just trying to cover your tracks, you don't need to (and, in fact, shouldn't) limit yourself to hosts on the target network. Before you go scanning random Internet addresses for vulnerable FTP servers, consider that sysadmins may not appreciate you abusing their servers in this way.
.SH "PORT SPECIFICATION AND SCAN ORDER"
.PP
In addition to all of the scan methods discussed previously, Nmap offers options for specifying which ports are scanned and whether the scan order is randomized or sequential. By default, Nmap scans all ports up to and including 1024 as well as higher numbered ports listed in the
\fInmap\-services\fR
file for the protocol(s) being scanned.
.TP
\fB\-p <port ranges>\fR (Only scan specified ports)
This option specifies which ports you want to scan and overrides the default. Individual port numbers are OK, as are ranges separated by a hyphen (e.g. 1\-1023). The beginning and/or end values of a range may be omitted, causing Nmap to use 1 and 65535, respectively. So you can specify
\fB\-p\-\fR
to scan ports from 1 through 65535. Scanning port zero is allowed if you specify it explicitly. For IP protocol scanning (\fB\-sO\fR), this option specifies the protocol numbers you wish to scan for (0\-255).
.sp
When scanning both TCP and UDP ports, you can specify a particular protocol by preceding the port numbers by
T:
or
U:. The qualifier lasts until you specify another qualifier. For example, the argument
\fB\-p U:53,111,137,T:21\-25,80,139,8080\fR
would scan UDP ports 53,111,and 137, as well as the listed TCP ports. Note that to scan both UDP & TCP, you have to specify
\fB\-sU\fR
and at least one TCP scan type (such as
\fB\-sS\fR,
\fB\-sF\fR, or
\fB\-sT\fR). If no protocol qualifier is given, the port numbers are added to all protocol lists.
.TP
\fB\-F\fR (Fast (limited port) scan)
Specifies that you only wish to scan for ports listed in the
\fInmap\-services\fR
file which comes with nmap (or the protocols file for
\fB\-sO\fR). This is much faster than scanning all 65535 ports on a host. Because this list contains so many TCP ports (more than 1200), the speed difference from a default TCP scan (about 1650 ports) isn't dramatic. The difference can be enormous if you specify your own tiny
\fInmap\-services\fR
file using the
\fB\-\-datadir\fR
option.
.TP
\fB\-r\fR (Don't randomize ports)
By default, Nmap randomizes the scanned port order (except that certain commonly accessible ports are moved near the beginning for efficiency reasons). This randomization is normally desirable, but you can specify
\fB\-r\fR
for sequential port scanning instead.
.SH "SERVICE AND VERSION DETECTION"
.PP
Point Nmap at a remote machine and it might tell you that ports 25/tcp, 80/tcp, and 53/udp are open. Using its
\fInmap\-services\fR
database of about 2,200 well\-known services, Nmap would report that those ports probably correspond to a mail server (SMTP), web server (HTTP), and name server (DNS) respectively. This lookup is usually accurate \-\- the vast majority of daemons listening on TCP port 25 are, in fact, mail servers. However, you should not bet your security on this! People can and do run services on strange ports.
.PP
Even if Nmap is right, and the hypothetical server above is running SMTP, HTTP, and DNS servers, that is not a lot of information. When doing vulnerability assessments (or even simple network inventories) of your companies or clients, you really want to know which mail and DNS servers and versions are running. Having an accurate version number helps dramatically in determining which exploits a server is vulnerable to. Version detection helps you obtain this information.
.PP
After TCP and/or UDP ports are discovered using one of the other scan methods, version detection interrogates those ports to determine more about what is actually running. The
\fInmap\-service\-probes\fR
database contains probes for querying various services and match expressions to recognize and parse responses. Nmap tries to determine the service protocol (e.g. ftp, ssh, telnet, http), the application name (e.g. ISC Bind, Apache httpd, Solaris telnetd), the version number, hostname, device type (e.g. printer, router), the OS family (e.g. Windows, Linux) and sometimes miscellaneous details like whether an X server is open to connections, the SSH protocol version, or the KaZaA user name). Of course, most services don't provide all of this information. If Nmap was compiled with OpenSSL support, it will connect to SSL servers to deduce the service listening behind that encryption layer. When RPC services are discovered, the Nmap RPC grinder (\fB\-sR\fR) is automatically used to determine the RPC program and version numbers. Some UDP ports are left in the
open|filtered
state after a UDP port scan is unable to determine whether the port is open or filtered. Version detection will try to elicit a response from these ports (just as it does with open ports), and change the state to open if it succeeds.
open|filtered
TCP ports are treated the same way. Note that the Nmap
\fB\-A\fR
option enables version detection among other things. A paper documenting the workings, usage, and customization of version detection is available at
\fI\%http://www.insecure.org/nmap/vscan/\fR.
.PP
When Nmap receives responses from a service but cannot match them to its database, it prints out a special fingerprint and a URL for you to submit if to if you know for sure what is running on the port. Please take a couple minutes to make the submission so that your find can benefit everyone. Thanks to these submissions, Nmap has about 3,000 pattern matches for more than 350 protocols such as smtp, ftp, http, etc.
.PP
Version detection is enabled and controlled with the following options:
.TP
\fB\-sV\fR (Version detection)
Enables version detection, as discussed above. Alternatively, you can use
\fB\-A\fR
to enable both OS detection and version detection.
.TP
\fB\-\-allports\fR (Don't exclude any ports from version detection)
By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP get requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the
Exclude
directive in
\fInmap\-service\-probes\fR, or you can specify
\fB\-\-allports\fR
to scan all ports regardless of any
Exclude
directive.
.TP
\fB\-\-version\-intensity <intensity>\fR (Set version scan intensity)
When performing a version scan (\fB\-sV\fR), nmap sends a series of probes, each of which is assigned a rarity value between 1 and 9. The lower\-numbered probes are effective against a wide variety of common services, while the higher numbered ones are rarely useful. The intensity level specifies which probes should be applied. The higher the number, the more likely it is the service will be correctly identified. However, high intensity scans take longer. The intensity must be between 0 and 9. The default is 7. When a probe is registered to the target port via the
\fInmap\-service\-probes\fRports
directive, that probe is tried regardless of intensity level. This ensures that the DNS probes will always be attempted against any open port 53, the SSL probe will be done against 443, etc.
.TP
\fB\-\-version\-light\fR (Enable light mode)
This is a convenience alias for
\fB\-\-version\-intensity 2\fR. This light mode makes version scanning much faster, but it is slightly less likely to identify services.
.TP
\fB\-\-version\-all\fR (Try every single probe)
An alias for
\fB\-\-version\-intensity 9\fR, ensuring that every single probe is attempted against each port.
.TP
\fB\-\-version\-trace\fR (Trace version scan activity)
This causes Nmap to print out extensive debugging info about what version scanning is doing. It is a subset of what you get with
\fB\-\-packet\-trace\fR.
.TP
\fB\-sR\fR (RPC scan)
This method works in conjunction with the various port scan methods of Nmap. It takes all the TCP/UDP ports found open and floods them with SunRPC program NULL commands in an attempt to determine whether they are RPC ports, and if so, what program and version number they serve up. Thus you can effectively obtain the same info as
\fBrpcinfo \-p\fR
even if the target's portmapper is behind a firewall (or protected by TCP wrappers). Decoys do not currently work with RPC scan. This is automatically enabled as part of version scan (\fB\-sV\fR) if you request that. As version detection includes this and is much more comprehensive,
\fB\-sR\fR
is rarely needed.
.SH "OS DETECTION"
.PP
One of Nmap's best\-known features is remote OS detection using TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in the responses. After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IPID sampling, and the initial window size check, Nmap compares the results to its
\fInmap\-os\-fingerprints\fR
database of more than 1500 known OS fingerprints and prints out the OS details if there is a match. Each fingerprint includes a freeform textual description of the OS, and a classification which provides the vendor name (e.g. Sun), underlying OS (e.g. Solaris), OS generation (e.g. 10), and device type (general purpose, router, switch, game console, etc).
.PP
If Nmap is unable to guess the OS of a machine, and conditions are good (e.g. at least one open port and one closed port were found), Nmap will provide a URL you can use to submit the fingerprint if you know (for sure) the OS running on the machine. By doing this you contribute to the pool of operating systems known to Nmap and thus it will be more accurate for everyone.
.PP
OS detection enables several other tests which make use of information that is gathered during the process anyway. One of these is uptime measurement, which uses the TCP timestamp option (RFC 1323) to guess when a machine was last rebooted. This is only reported for machines which provide this information. Another is TCP Sequence Predictability Classification. This measures approximately how hard it is to establish a forged TCP connection against the remote host. It is useful for exploiting source\-IP based trust relationships (rlogin, firewall filters, etc) or for hiding the source of an attack. This sort of spoofing is rarely performed any more, but many machines are still vulnerable to it. The actual difficulty number is based on statistical sampling and may fluctuate. It is generally better to use the English classification such as
\(lqworthy challenge\(rq
or
\(lqtrivial joke\(rq. This is only reported in normal output in verbose (\fB\-v\fR) mode. When verbose mode is enabled along with
\fB\-O\fR, IPID Sequence Generation is also reported. Most machines are in the
\(lqincremental\(rq
class, which means that they increment the ID field in the IP header for each packet they send. This makes them vulnerable to several advanced information gathering and spoofing attacks.
.PP
A paper documenting the workings, usage, and customization of version detection is available in more than a dozen languages at
\fI\%http://www.insecure.org/nmap/nmap\-fingerprinting\-article.html\fR.
.PP
OS detection is enabled and controlled with the following options:
.TP
\fB\-O\fR (Enable OS detection)
Enables OS detection, as discussed above. Alternatively, you can use
\fB\-A\fR
to enable both OS detection and version detection.
.TP
\fB\-\-osscan\-limit\fR (Limit OS detection to promising targets)
OS detection is far more effective if at least one open and one closed TCP port are found. Set this option and Nmap will not even try OS detection against hosts that do not meet this criteria. This can save substantial time, particularly on
\fB\-P0\fR
scans against many hosts. It only matters when OS detection is requested with
\fB\-O\fR
or
\fB\-A\fR.
.TP
\fB\-\-osscan\-guess\fR; \fB\-\-fuzzy\fR (Guess OS detection results)
When Nmap is unable to detect a perfect OS match, it sometimes offers up near\-matches as possibilities. The match has to be very close for Nmap to do this by default. Either of these (equivalent) options make Nmap guess more aggressively. Nmap will still tell you when an imperfect match is printed and display its confidence level (percentage) for each guess.
.SH "TIMING AND PERFORMANCE"
.PP
One of my highest Nmap development priorities has always been performance. A default scan (\fBnmap \fR\fB\fIhostname\fR\fR) of a host on my local network takes a fifth of a second. That is barely enough time to blink, but adds up when you are scanning tens or hundreds of thousands of hosts. Moreover, certain scan options such as UDP scanning and version detection can increase scan times substantially. So can certain firewall configurations, particularly response rate limiting. While Nmap utilizes parallelism and many advanced algorithms to accelerate these scans, the user has ultimate control over how Nmap runs. Expert users carefully craft Nmap commands to obtain only the information they care about while meeting their time constraints.
.PP
Techniques for improving scan times include omitting non\-critical tests, and upgrading to the latest version of Nmap (performance enhancements are made frequently). Optimizing timing parameters can also make a substantial difference. Those options are listed below.
.PP
Some options accept a
time
parameter. This is specified in milliseconds by default, though you can append \(oqs\(cq, \(oqm\(cq, or \(oqh\(cq to the value to specify seconds, minutes, or hours. So the
\fB\-\-host\-timeout\fR
arguments
900000,
900s, and
15m
all do the same thing.
.TP
\fB\-\-min\-hostgroup <numhosts>\fR; \fB\-\-max\-hostgroup <numhosts>\fR (Adjust parallel scan group sizes)
Nmap has the ability to port scan or version scan multiple hosts in parallel. Nmap does this by dividing the target IP space into groups and then scanning one group at a time. In general, larger groups are more efficient. The downside is that host results can't be provided until the whole group is finished. So if Nmap started out with a group size of 50, the user would not receive any reports (except for the updates offered in verbose mode) until the first 50 hosts are completed.
.sp
By default, Nmap takes a compromise approach to this conflict. It starts out with a group size as low as five so the first results come quickly and then increases the groupsize to as high as 1024. The exact default numbers depend on the options given. For efficiency reasons, Nmap uses larger group sizes for UDP or few\-port TCP scans.
.sp
When a maximum group size is specified with
\fB\-\-max\-hostgroup\fR, Nmap will never exceed that size. Specify a minimum size with
\fB\-\-min\-hostgroup\fR
and Nmap will try to keep group sizes above that level. Nmap may have to use smaller groups than you specify if there are not enough target hosts left on a given interface to fulfill the specified minimum. Both may be set to keep the group size within a specific range, though this is rarely desired.
.sp
The primary use of these options is to specify a large minimum group size so that the full scan runs more quickly. A common choice is 256 to scan a network in Class C sized chunks. For a scan with many ports, exceeding that number is unlikely to help much. For scans of just a few port numbers, host group sizes of 2048 or more may be helpful.
.TP
\fB\-\-min\-parallelism <numprobes>\fR; \fB\-\-max\-parallelism <numprobes>\fR (Adjust probe parallelization)
These options control the total number of probes that may be outstanding for a host group. They are used for port scanning and host discovery. By default, Nmap calculates an ever\-changing ideal parallelism based on network performance. If packets are being dropped, Nmap slows down and allows fewer outstanding probes. The ideal probe number slowly rises as the network proves itself worthy. These options place minimum or maximum bounds on that variable. By default, the ideal parallelism can drop to 1 if the network proves unreliable and rise to several hundred in perfect conditions.
.sp
The most common usage is to set
\fB\-\-min\-parallelism\fR
to a number higher than one to speed up scans of poorly performing hosts or networks. This is a risky option to play with, as setting it too high may affect accuracy. Setting this also reduces Nmap's ability to control parallelism dynamically based on network conditions. A value of ten might be reasonable, though I only adjust this value as a last resort.
.sp
The
\fB\-\-max\-parallelism\fR
option is sometimes set to one to prevent Nmap from sending more than one probe at a time to hosts. This can be useful in combination with
\fB\-\-scan\-delay\fR
(discussed later), although the latter usually serves the purpose well enough by itself.
.TP
\fB\-\-min\-rtt\-timeout <time>\fR, \fB\-\-max\-rtt\-timeout <time>\fR, \fB\-\-initial\-rtt\-timeout <time>\fR (Adjust probe timeouts)
Nmap maintains a running timeout value for determining how long it will wait for a probe response before giving up or retransmitting the probe. This is calculated based on the response times of previous probes. If the network latency shows itself to be significant and variable, this timeout can grow to several seconds. It also starts at a conservative (high) level and may stay that way for a while when Nmap scans unresponsive hosts.
.sp
Specifying a lower
\fB\-\-max\-rtt\-timeout\fR
and
\fB\-\-initial\-rtt\-timeout\fR
than the defaults can cut scan times significantly. This is particularly true for pingless (\fB\-P0\fR) scans, and those against heavily filtered networks. Don't get too aggressive though. The scan can end up taking longer if you specify such a low value that many probes are timing out and retransmitting while the response is in transit.
.sp
If all the hosts are on a local network, 100 milliseconds is a reasonable aggressive
\fB\-\-max\-rtt\-timeout\fR
value. If routing is involved, ping a host on the network first with the ICMP ping utility, or with a custom packet crafter such as hping2 that is more likely to get through a firewall. Look at the maximum round trip time out of ten packets or so. You might want to double that for the
\fB\-\-initial\-rtt\-timeout\fR
and triple or quadruple it for the
\fB\-\-max\-rtt\-timeout\fR. I generally do not set the maximum rtt below 100ms, no matter what the ping times are. Nor do I exceed 1000ms.
.sp
\fB\-\-min\-rtt\-timeout\fR
is a rarely used option that could be useful when a network is so unreliable that even Nmap's default is too aggressive. Since Nmap only reduces the timeout down to the minimum when the network seems to be reliable, this need is unusual and should be reported as a bug to the nmap\-dev mailing list.
.TP
\fB\-\-max\-retries <numtries>\fR (Specify the maximum number of port scan probe retransmissions)
When Nmap receives no response to a port scan probe, it could mean the port is filtered. Or maybe the probe or response was simply lost on the network. It is also possible that the target host has rate limiting enabled that temporarily blocked the response. So Nmap tries again by retransmitting the initial probe. If Nmap detects poor network reliability, it may try many more times before giving up on a port. While this benefits accuracy, it also lengthen scan times. When performance is critical, scans may be sped up by limiting the number of retransmissions allowed. You can even specify
\fB\-\-max\-retries 0\fR
to prevent any retransmissions, though that is rarely recommended.
.sp
The default (with no
\fB\-T\fR
template) is to allow ten retransmissions. If a network seems reliable and the target hosts aren't rate limiting, Nmap usually only does one retransmission. So most target scans aren't even affected by dropping
\fB\-\-max\-retries\fR
to a low value such as three. Such values can substantially speed scans of slow (rate limited) hosts. You usually lose some information when Nmap gives up on ports early, though that may be preferable to letting the
\fB\-\-host\-timeout\fR
expire and losing all information about the target.
.TP
\fB\-\-host\-timeout <time>\fR (Give up on slow target hosts)
Some hosts simply take a
\fIlong\fR
time to scan. This may be due to poorly performing or unreliable networking hardware or software, packet rate limiting, or a restrictive firewall. The slowest few percent of the scanned hosts can eat up a majority of the scan time. Sometimes it is best to cut your losses and skip those hosts initially. Specify
\fB\-\-host\-timeout\fR
with the maximum amoung of time you are willing to wait. I often specify
30m
to ensure that Nmap doesn't waste more than half an hour on a single host. Note that Nmap may be scanning other hosts at the same time during that half an hour as well, so it isn't a complete loss. A host that times out is skipped. No port table, OS detection, or version detection results are printed for that host.
.TP
\fB\-\-scan\-delay <time>\fR; \fB\-\-max\-scan\-delay <time>\fR (Adjust delay between probes)
This option causes Nmap to wait at least the given amount of time between each probe it sends to a given host. This is particularly useful in the case of rate limiting. Solaris machines (among many others) will usually respond to UDP scan probe packets with only one ICMP message per second. Any more than that sent by Nmap will be wasteful. A
\fB\-\-scan\-delay\fR
of
1s
will keep Nmap at that slow rate. Nmap tries to detect rate limiting and adjust the scan delay accordingly, but it doesn't hurt to specify it explicitly if you already know what rate works best.
.sp
When Nmap adjusts the scan delay upward to cope with rate limiting, the scan slows down dramatically. The
\fB\-\-max\-scan\-delay\fR
option specifies the largest delay that Nmap will allow. Setting this value too low can lead to wasteful packet retransmissions and possible missed ports when the target implements strict rate limiting.
.sp
Another use of
\fB\-\-scan\-delay\fR
is to evade threshold based intrusion detection and prevention systems (IDS/IPS).
.TP
\fB\-\-defeat\-rst\-ratelimit\fR
Many hosts have long used rate limiting to reduce the number of ICMP error messages (such as port\-unreachable errors) they send. Some systems now apply similar rate limits to the RST (reset) packets they generate. This can slow Nmap down dramatically as it adjusts its timing to reflect those rate limits. You can tell Nmap to ignore those rate limits (for port scans such as SYN scan which
\fIdon't\fR
treat nonresponsive ports as
open) by specifying
\fB\-\-defeat\-rst\-ratelimit\fR.
.sp
Using this option can reduce accuracy, as some ports will appear nonresponse because Nmap didn't wait long enough for a rate\-limited RST response. With a SYN scan, the non\-response results in the port being labeled
filtered
rather than the
closed
state we see when RST packets are received. This optional is useful when you only care about open ports, and distinguishing between
closed
and
filtered
ports isn't worth the extra time.
.TP
\fB\-T <Paranoid|Sneaky|Polite|Normal|Aggressive|Insane>\fR (Set a timing template)
While the fine grained timing controls discussed in the previous section are powerful and effective, some people find them confusing. Moreover, choosing the appropriate values can sometimes take more time than the scan you are trying to optimize. So Nmap offers a simpler approach, with six timing templates. You can specify them with the
\fB\-T\fR
option and their number (0 \- 5) or their name. The template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion. Polite mode slows down the scan to use less bandwidth and target machine resources. Normal mode is the default and so
\fB\-T3\fR
does nothing. Aggressive mode speeds scans up by making the assumption that you are on a reasonably fast and reliable network. Finally Insane mode assumes that you are on an extraordinarily fast network or are willing to sacrifice some accuracy for speed.
.sp
These templates allow the user to specify how aggressive they wish to be, while leaving Nmap to pick the exact timing values. The templates also make some minor speed adjustments for which fine grained control options do not currently exist. For example,
\fB\-T4\fR
prohibits the dynamic scan delay from exceeding 10ms for TCP ports and
\fB\-T5\fR
caps that value at 5 milliseconds. Templates can be used in combination with fine grained controls, and the fine\-grained controls will you specify will take precedence over the timing template default for that parameter. I recommend using
\fB\-T4\fR
when scanning reasonably modern and reliable networks. Keep that option even when you add fine grained controls so that you benefit from those extra minor optimizations that it enables.
.sp
If you are on a decent broadband or ethernet connection, I would recommend always using
\fB\-T4\fR. Some people love
\fB\-T5\fR
though it is too aggressive for my taste. People sometimes specify
\fB\-T2\fR
because they think it is less likely to crash hosts or because they consider themselves to be polite in general. They often don't realize just how slow
\fB\-T Polite\fR
really is. Their scan may take ten times longer than a default scan. Machine crashes and bandwidth problems are rare with the default timing options (\fB\-T3\fR) and so I normally recommend that for cautious scanners. Omitting version detection is far more effective than playing with timing values at reducing these problems.
.sp
While
\fB\-T0\fR
and
\fB\-T1\fR
may be useful for avoiding IDS alerts, they will take an extraordinarily long time to scan thousands of machines or ports. For such a long scan, you may prefer to set the exact timing values you need rather than rely on the canned
\fB\-T0\fR
and
\fB\-T1\fR
values.
.sp
The main effects of
\fBT0\fR
are serializing the scan so only one port is scanned at a time, and waiting five minutes between sending each probe.
\fBT1\fR
and
\fBT2\fR
are similar but they only wait 15 seconds and 0.4 seconds, respectively, between probes.
\fBT3\fR
is Nmap's default behavior, which includes parallelization.
\fBT4\fR
does the equivalent of
\fB\-\-max\-rtt\-timeout 1250 \-\-initial\-rtt\-timeout 500 \-\-max\-retries 6\fR
and sets the maximum TCP scan delay to 10 milliseconds.
\fBT5\fR
does the equivalent of
\fB\-\-max\-rtt\-timeout 300 \-\-min\-rtt\-timeout 50 \-\-initial\-rtt\-timeout 250 \-\-max\-retries 2 \-\-host\-timeout 15m\fR
as well as setting the maximum TCP scan delay to 5ms.
.SH "FIREWALL/IDS EVASION AND SPOOFING"
.PP
Many Internet pioneers envisioned a global open network with a universal IP address space allowing virtual connections between any two nodes. This allows hosts to act as true peers, serving and retrieving information from each other. People could access all of their home systems from work, changing the climate control settings or unlocking the doors for early guests. This vision of universal connectivity has been stifled by address space shortages and security concerns. In the early 1990s, organizations began deploying firewalls for the express purpose of reducing connectivity. Huge networks were cordoned off from the unfiltered Internet by application proxies, network address translation, and packet filters. The unrestricted flow of information gave way to tight regulation of approved communication channels and the content that passes over them.
.PP
Network obstructions such as firewalls can make mapping a network exceedingly difficult. It will not get any easier, as stifling casual reconnaissance is often a key goal of implementing the devices. Nevertheless, Nmap offers many features to help understand these complex networks, and to verify that filters are working as intended. It even supports mechanisms for bypassing poorly implemented defenses. One of the best methods of understanding your network security posture is to try to defeat it. Place yourself in the mindset of an attacker, and deploy techniques from this section against your networks. Launch an FTP bounce scan, Idle scan, fragmentation attack, or try to tunnel through one of your own proxies.
.PP
In addition to restricting network activity, companies are increasingly monitoring traffic with intrusion detection systems (IDS). All of the major IDSs ship with rules designed to detect Nmap scans because scans are sometimes a precursor to attacks. Many of these products have recently morphed into intrusion
\fIprevention\fR
systems (IPS) that actively block traffic deemed malicious. Unfortunately for network administrators and IDS vendors, reliably detecting bad intentions by analyzing packet data is a tough problem. Attackers with patience, skill, and the help of certain Nmap options can usually pass by IDSs undetected. Meanwhile, administrators must cope with large numbers of false positive results where innocent activity is misdiagnosed and alerted on or blocked.
.PP
Occasionally people suggest that Nmap should not offer features for evading firewall rules or sneaking past IDSs. They argue that these features are just as likely to be misused by attackers as used by administrators to enhance security. The problem with this logic is that these methods would still be used by attackers, who would just find other tools or patch the functionality into Nmap. Meanwhile, administrators would find it that much harder to do their jobs. Deploying only modern, patched FTP servers is a far more powerful defense than trying to prevent the distribution of tools implementing the FTP bounce attack.
.PP
There is no magic bullet (or Nmap option) for detecting and subverting firewalls and IDS systems. It takes skill and experience. A tutorial is beyond the scope of this reference guide, which only lists the relevant options and describes what they do.
.TP
\fB\-f\fR (fragment packets); \fB\-\-mtu\fR (using the specified MTU)
The
\fB\-f\fR
option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets. The old\-school sniffer named Sniffit segmentation faulted immediately upon receiving the first fragment. Specify this option once, and Nmap splits the packets into 8 bytes or less after the IP header. So a 20\-byte TCP header would be split into 3 packets. Two with eight bytes of the TCP header, and one with the final four. Of course each fragment also has an IP header. Specify
\fB\-f\fR
again to use 16 bytes per fragment (reducing the number of fragments). Or you can specify your own offset size with the
\fB\-\-mtu\fR
option. Don't also specify
\fB\-f\fR
if you use
\fB\-\-mtu\fR. The offset must be a multiple of 8. While fragmented packets won't get by packet filters and firewalls that queue all IP fragments, such as the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel, some networks can't afford the performance hit this causes and thus leave it disabled. Others can't enable this because fragments may take different routes into their networks. Some source systems defragment outgoing packets in the kernel. Linux with the iptables connection tracking module is one such example. Do a scan while a sniffer such as Ethereal is running to ensure that sent packets are fragmented. If your host OS is causing problems, try the
\fB\-\-send\-eth\fR
option to bypass the IP layer and send raw ethernet frames.
.TP
\fB\-D <decoy1 [,decoy2][,ME],...>\fR (Cloak a scan with decoys)
Causes a decoy scan to be performed, which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5\-10 port scans from unique IP addresses, but they won't know which IP was scanning them and which were innocent decoys. While this can be defeated through router path tracing, response\-dropping, and other active mechanisms, it is generally an effective technique for hiding your IP address.
.sp
Separate each decoy host with commas, and you can optionally use
ME
as one of the decoys to represent the position for your real IP address. If you put
ME
in the 6th position or later, some common port scan detectors (such as Solar Designer's excellent scanlogd) are unlikely to show your IP address at all. If you don't use
ME, nmap will put you in a random position.
.sp
Note that the hosts you use as decoys should be up or you might accidentally SYN flood your targets. Also it will be pretty easy to determine which host is scanning if only one is actually up on the network. You might want to use IP addresses instead of names (so the decoy networks don't see you in their nameserver logs).
.sp
Decoys are used both in the initial ping scan (using ICMP, SYN, ACK, or whatever) and during the actual port scanning phase. Decoys are also used during remote OS detection (\fB\-O\fR). Decoys do not work with version detection or TCP connect scan.
.sp
It is worth noting that using too many decoys may slow your scan and potentially even make it less accurate. Also, some ISPs will filter out your spoofed packets, but many do not restrict spoofed IP packets at all.
.TP
\fB\-S <IP_Address>\fR (Spoof source address)
In some circumstances, Nmap may not be able to determine your source address ( Nmap will tell you if this is the case). In this situation, use
\fB\-S\fR
with the IP address of the interface you wish to send packets through.
.sp
Another possible use of this flag is to spoof the scan to make the targets think that
\fIsomeone else\fR
is scanning them. Imagine a company being repeatedly port scanned by a competitor! The
\fB\-e\fR
option would generally be required for this sort of usage, and
\fB\-P0\fR
would normally be advisable as well.
.TP
\fB\-e <interface>\fR (Use specified interface)
Tells Nmap what interface to send and receive packets on. Nmap should be able to detect this automatically, but it will tell you if it cannot.
.TP
\fB\-\-source\-port <portnumber>;\fR \fB\-g <portnumber>\fR (Spoof source port number)
One surprisingly common misconfiguration is to trust traffic based only on the source port number. It is easy to understand how this comes about. An administrator will set up a shiny new firewall, only to be flooded with complains from ungrateful users whose applications stopped working. In particular, DNS may be broken because the UDP DNS replies from external servers can no longer enter the network. FTP is another common example. In active FTP transfers, the remote server tries to establish a connection back to the client to transfer the requested file.
.sp
Secure solutions to these problems exist, often in the form of application\-level proxies or protocol\-parsing firewall modules. Unfortunately there are also easier, insecure solutions. Noting that DNS replies come from port 53 and active ftp from port 20, many admins have fallen into the trap of simply allowing incoming traffic from those ports. They often assume that no attacker would notice and exploit such firewall holes. In other cases, admins consider this a short\-term stop\-gap measure until they can implement a more secure solution. Then they forget the security upgrade.
.sp
Overworked network administrators are not the only ones to fall into this trap. Numerous products have shipped with these insecure rules. Even Microsoft has been guilty. The IPsec filters that shipped with Windows 2000 and Windows XP contain an implicit rule that allows all TCP or UDP traffic from port 88 (Kerberos). In another well\-known case, versions of the Zone Alarm personal firewall up to 2.1.25 allowed any incoming UDP packets with the source port 53 (DNS) or 67 (DHCP).
.sp
Nmap offers the
\fB\-g\fR
and
\fB\-\-source\-port\fR
options (they are equivalent) to exploit these weaknesses. Simply provide a port number and Nmap will send packets from that port where possible. Nmap must use different port numbers for certain OS detection tests to work properly, and DNS requests ignore the
\fB\-\-source\-port\fR
flag because Nmap relies on system libraries to handle those. Most TCP scans, including SYN scan, support the option completely, as does UDP scan.
.TP
\fB\-\-data\-length <number>\fR (Append random data to sent packets)
Normally Nmap sends minimalist packets containing only a header. So its TCP packets are generally 40 bytes and ICMP echo requests are just 28. This option tells Nmap to append the given number of random bytes to most of the packets it sends. OS detection (\fB\-O\fR) packets are not affected because accuracy there requires probe consistency, but most pinging and portscan packets support this. It slows things down a little, but can make a scan slightly less conspicuous.
.TP
\fB\-\-ttl <value>\fR (Set IP time\-to\-live field)
Sets the IPv4 time\-to\-live field in sent packets to the given value.
.TP
\fB\-\-randomize\-hosts\fR (Randomize target host order)
Tells Nmap to shuffle each group of up to 8096 hosts before it scans them. This can make the scans less obvious to various network monitoring systems, especially when you combine it with slow timing options. If you want to randomize over larger group sizes, increase PING_GROUP_SZ in
\fInmap.h\fR
and recompile. An alternative solution is to generate the target IP list with a list scan (\fB\-sL \-n \-oN \fR\fB\fIfilename\fR\fR), randomize it with a Perl script, then provide the whole list to Nmap with
\fB\-iL\fR.
.TP
\fB\-\-spoof\-mac <mac address, prefix, or vendor name>\fR (Spoof MAC address)
Asks Nmap to use the given MAC address for all of the raw ethernet frames it sends. This option implies
\fB\-\-send\-eth\fR
to ensure that Nmap actually sends ethernet\-level packets. The MAC given can take several formats. If it is simply the string
\(lq0\(rq, Nmap chooses a completely random MAC for the session. If the given string is an even number of hex digits (with the pairs optionally separated by a colon), Nmap will use those as the MAC. If less than 12 hex digits are provided, Nmap fills in the remainder of the 6 bytes with random values. If the argument isn't a 0 or hex string, Nmap looks through
\fInmap\-mac\-prefixes\fR
to find a vendor name containing the given string (it is case insensitive). If a match is found, Nmap uses the vendor's OUI (3\-byte prefix) and fills out the remaining 3 bytes randomly. Valid
\fB\-\-spoof\-mac\fR
argument examples are
Apple,
0,
01:02:03:04:05:06,
deadbeefcafe,
0020F2, and
Cisco.
.TP
\fB\-\-badsum\fR (Send packets with bogus TCP/UDP checksums)
Asks Nmap to use an invalid TCP or UDP checksum for packets sent to target hosts. Since virtually all host IP stacks properly drop these packets, any responses received are likely coming from a firewall or IDS that didn't bother to verify the checksum. For more details on this technique, see
\fI\%http://www.phrack.org/phrack/60/p60\-0x0c.txt\fR
.SH "OUTPUT"
.PP
Any security tools is only as useful as the output it generates. Complex tests and algorithms are of little value if they aren't presented in an organized and comprehensible fashion. Given the number of ways Nmap is used by people and other software, no single format can please everyone. So Nmap offers several formats, including the interactive mode for humans to read directly and XML for easy parsing by software.
.PP
In addition to offering different output formats, Nmap provides options for controlling the verbosity of output as well as debugging messages. Output types may be sent to standard output or to named files, which Nmap can append to or clobber. Output files may also be used to resume aborted scans.
.PP
Nmap makes output available in five different formats. The default is called
interactive output, and it is sent to standard output (stdout). There is also
normal output, which is similar to
interactive
except that it displays less runtime information and warnings since it is expected to be analyzed after the scan completes rather than interactively.
.PP
XML output is one of the most important output types, as it can be converted to HTML, easily parsed by programs such as Nmap graphical user interfaces, or imported into databases.
.PP
The two remaining output types are the simple
grepable output
which includes most information for a target host on a single line, and
sCRiPt KiDDi3 0utPUt
for users who consider themselves |<\-r4d.
.PP
While interactive output is the default and has no associated command\-line options, the other four format options use the same syntax. They take one argument, which is the filename that results should be stored in. Multiple formats may be specified, but each format may only be specified once. For example, you may wish to save normal output for your own review while saving XML of the same scan for programmatic analysis. You might do this with the options
\fB\-oX myscan.xml \-oN myscan.nmap\fR. While this chapter uses the simple names like
myscan.xml
for brevity, more descriptive names are generally recommended. The names chosen are a matter of personal preference, though I use long ones that incorporate the scan date and a word or two describing the scan, placed in a directory named after the company I'm scanning.
.PP
While these options save results to files, Nmap still prints interactive output to stdout as usual. For example, the command
\fBnmap \-oX myscan.xml target\fR
prints XML to
\fImyscan.xml\fR
and fills standard output with the same interactive results it would have printed if
\fB\-oX\fR
wasn't specified at all. You can change this by passing a hyphen character as the argument to one of the format types. This causes Nmap to deactivate interactive output, and instead print results in the format you specified to the standard output stream. So the command
\fBnmap \-oX \- target\fR
will send only XML output to stdout. Serious errors may still be printed to the normal error stream, stderr.
.PP
Unlike some Nmap arguments, the space between the logfile option flag (such as
\fB\-oX\fR) and the filename or hyphen is mandatory. If you omit the flags and give arguments such as
\fB\-oG\-\fR
or
\fB\-oXscan.xml\fR, a backwards compatibility feature of Nmap will cause the creation of
\fInormal format\fR
output files named
\fIG\-\fR
and
\fIXscan.xml\fR
respectively.
.PP
Nmap also offers options to control scan verbosity and to append to output files rather than clobbering them. All of these options are described below.
.PP
\fBNmap Output Formats\fR
.TP
\fB\-oN <filespec>\fR (Normal output)
Requests that
normal output
be directed to the given filename. As discussed above, this differs slightly from
interactive output.
.TP
\fB\-oX <filespec>\fR (XML output)
Requests that
XML output
be directed to the given filename. Nmap includes a document type definition (DTD) which allows XML parsers to validate Nmap XML output. While it is primarily intended for programmatic use, it can also help humans interpret Nmap XML output. The DTD defines the legal elements of the format, and often enumerates the attributes and values they can take on. The latest version is always available from
\fI\%http://www.insecure.org/nmap/data/nmap.dtd\fR.
.sp
XML offers a stable format that is easily parsed by software. Free XML parsers are available for all major computer languages, including C/C++, Perl, Python, and Java. People have even written bindings for most of these languages to handle Nmap output and execution specifically. Examples are
[6]\&\fINmap::Scanner\fR
and
[7]\&\fINmap::Parser\fR
in Perl CPAN. In almost all cases that a non\-trivial application interfaces with Nmap, XML is the preferred format.
.sp
The XML output references an XSL stylesheet which can be used to format the results as HTML. The easiest way to use this is simply to load the XML output in a web browser such as Firefox or IE. By default, this will only work on the machine you ran Nmap on (or a similarly configured one) due to the hard\-coded
\fInmap.xsl\fR
filesystem path. Use the
\fB\-\-webxml\fR
or
\fB\-\-stylesheet\fR
options to create portable XML files that render as HTML on any web\-connected machine.
.TP
\fB\-oS <filespec>\fR (ScRipT KIdd|3 oUTpuT)
Script kiddie output is like interactive output, except that it is post\-processed to better suit the l33t HaXXorZ who previously looked down on Nmap due to its consistent capitalization and spelling. Humor impaired people should note that this option is making fun of the script kiddies before flaming me for supposedly
\(lqhelping them\(rq.
.TP
\fB\-oG <filespec>\fR (Grepable output)
This output format is covered last because it is deprecated. The XML output format is far more powerful, and is nearly as convenient for experienced users. XML is a standard for which dozens of excellent parsers are available, while grepable output is my own simple hack. XML is extensible to support new Nmap features as they are released, while I often must omit those features from grepable output for lack of a place to put them.
.sp
Nevertheless, grepable output is still quite popular. It is a simple format that lists each host on one line and can be trivially searched and parsed with standard UNIX tools such as grep, awk, cut, sed, diff, and Perl. Even I usually use it for one\-off tests done at the command line. Finding all the hosts with the ssh port open or that are running Solaris takes only a simple grep to identify the hosts, piped to an awk or cut command to print the desired fields.
.sp
Grepable output consists of comments (lines starting with a pound (#)) and target lines. A target line includes a combination of 6 labeled fields, separated by tabs and followed with a colon. The fields are
Host,
Ports,
Protocols,
Ignored State,
OS,
Seq Index,
IPID, and
Status.
.sp
The most important of these fields is generally
Ports, which gives details on each interesting port. It is a comma separated list of port entries. Each port entry represents one interesting port, and takes the form of seven slash (/) separated subfields. Those subfields are:
Port number,
State,
Protocol,
Owner,
Service,
SunRPC info, and
Version info.
.sp
As with XML output, this man page does not allow for documenting the entire format. A more detailed look at the Nmap grepable output format is available from
\fI\%http://www.unspecific.com/nmap\-oG\-output\fR.
.TP
\fB\-oA <basename>\fR (Output to all formats)

As a convenience, you may specify
\fB\-oA \fR\fB\fIbasename\fR\fR
to store scan results in normal, XML, and grepable formats at once. They are stored in
\fIbasename\fR.nmap,
\fIbasename\fR.xml, and
\fIbasename\fR.gnmap, respectively. As with most programs, you can prefix the filenames with a directory path, such as
\fI~/nmaplogs/foocorp/\fR
on UNIX or
\fIc:\\hacking\\sco\fR
on Windows.
.PP
\fBVerbosity and debugging options\fR
.TP
\fB\-v\fR (Increase verbosity level)
Increases the verbosity level, causing Nmap to print more information about the scan in progress. Open ports are shown as they are found and completion time estimates are provided when Nmap thinks a scan will take more than a few minutes. Use it twice for even greater verbosity. Using it more than twice has no effect.
.sp
Most changes only affect interactive output, and some also affect normal and script kiddie output. The other output types are meant to be processed by machines, so Nmap can give substantial detail by default in those formats without fatiguing a human user. However, there are a few changes in other modes where output size can be reduced substantially by omitting some detail. For example, a comment line in the grepable output that provides a list of all ports scanned is only printed in verbose mode because it can be quite long.
.TP
\fB\-d [level]\fR (Increase or set debugging level)
When even verbose mode doesn't provide sufficient data for you, debugging is available to flood you with much more! As with the verbosity option (\fB\-v\fR), debugging is enabled with a command\-line flag (\fB\-d\fR) and the debug level can be increased by specifying it multiple times. Alternatively, you can set a debug level by giving an argument to
\fB\-d\fR. For example,
\fB\-d9\fR
sets level nine. That is the highest effective level and will produce thousands of lines unless you run a very simple scan with very few ports and targets.
.sp
Debugging output is useful when a bug is suspected in Nmap, or if you are simply confused as to what Nmap is doing and why. As this feature is mostly intended for developers, debug lines aren't always self\-explanatory. You may get something like:
Timeout vals: srtt: \-1 rttvar: \-1 to: 1000000 delta 14987 ==> srtt: 14987 rttvar: 14987 to: 100000. If you don't understand a line, your only recourses are to ignore it, look it up in the source code, or request help from the development list (nmap\-dev). Some lines are self explanatory, but the messages become more obscure as the debug level is increased.
.TP
\fB\-\-packet\-trace\fR (Trace packets and data sent and received)
Causes Nmap to print a summary of every packet sent or received. This is often used for debugging, but is also a valuable way for new users to understand exactly what Nmap is doing under the covers. To avoid printing thousands of lines, you may want to specify a limited number of ports to scan, such as
\fB\-p20\-30\fR. If you only care about the goings on of the version detection subsystem, use
\fB\-\-version\-trace\fR
instead.
.TP
\fB\-\-iflist\fR (List interfaces and routes)
Prints the interface list and system routes as detected by Nmap. This is useful for debugging routing problems or device mischaracterization (such as Nmap treating a PPP connection as Ethernet).
.TP
\fB\-\-log\-errors\fR (Log errors/warnings to normal mode output file)
Warnings and errors printed by Nmap usually go only to the screen (interactive output), leaving any specified normal\-fomat output files uncluttered. But when you do want to see those messages in the normal output file you specified, add this option. It is useful when you aren't watching the interactive output or are trying to debug a problem. The messages will also still appear in interactive mode. This will not work for most errors related to bad command\-line arguments, as Nmap may not have initialized its output files yet. In addition, some Nmap error/warning messages use a different system that does not yet support this option. An alternative to using this option is redirecting interactive output (including the standard error stream) to a file. While most UNIX shells make that approach easy, it can be difficult on Windows.
.PP
\fBMiscellaneous output options\fR
.TP
\fB\-\-append\-output\fR (Append to rather than clobber output files)
When you specify a filename to an output format flag such as
\fB\-oX\fR
or
\fB\-oN\fR, that file is overwritten by default. If you prefer to keep the existing content of the file and append the new results, specify the
\fB\-\-append\-output\fR
option. All output filenames specified in that Nmap execution will then be appended to rather than clobbered. This doesn't work well for XML (\fB\-oX\fR) scan data as the resultant file generally won't parse properly until you fix it up by hand.
.TP
\fB\-\-resume <filename>\fR (Resume aborted scan)
Some extensive Nmap runs take a very long time \-\- on the order of days. Such scans don't always run to completion. Restrictions may prevent Nmap from being run during working hours, the network could go down, the machine Nmap is running on might suffer a planned or unplanned reboot, or Nmap itself could crash. The admin running Nmap could cancel it for any other reason as well, by pressing
ctrl\-C. Restarting the whole scan from the beginning may be undesirable. Fortunately, if normal (\fB\-oN\fR) or grepable (\fB\-oG\fR) logs were kept, the user can ask Nmap to resume scanning with the target it was working on when execution ceased. Simply specify the
\fB\-\-resume\fR
option and pass the normal/grepable output file as its argument. No other arguments are permitted, as Nmap parses the output file to use the same ones specified previously. Simply call Nmap as
\fBnmap \-\-resume \fR\fB\fIlogfilename\fR\fR. Nmap will append new results to the data files specified in the previous execution. Resumption does not support the XML output format because combining the two runs into one valid XML file would be difficult.
.TP
\fB\-\-stylesheet <path or URL>\fR (Set XSL stylesheet to transform XML output)
Nmap ships with an XSL stylesheet named
\fInmap.xsl\fR
for viewing or translating XML output to HTML. The XML output includes an
xml\-stylesheet
directive which points to
\fInmap.xml\fR
where it was initially installed by Nmap (or in the current working directory on Windows). Simply load Nmap's XML output in a modern web browser and it should retrieve
\fInmap.xsl\fR
from the filesystem and use it to render results. If you wish to use a different stylesheet, specify it as the argument to
\fB\-\-stylesheet\fR. You must pass the full pathname or URL. One common invocation is
\fB\-\-stylesheet http://www.insecure.org/nmap/data/nmap.xsl\fR. This tells a browser to load the latest version of the stylesheet from Insecure.Org. The
\fB\-\-webxml\fR
option does the same thing with less typing and memorization. Loading the XSL from Insecure.Org makes it easier to view results on a machine that doesn't have Nmap (and thus
\fInmap.xsl\fR) installed. So the URL is often more useful, but the local filesystem location of nmap.xsl is used by default for privacy reasons.
.TP
\fB\-\-webxml\fR (Load stylesheet from Insecure.Org)
This convenience option is simply an alias for
\fB\-\-stylesheet http://www.insecure.org/nmap/data/nmap.xsl\fR.
.TP
\fB\-\-no_stylesheet\fR (Omit XSL stylesheet declaration from XML)
Specify this option to prevent Nmap from associating any XSL stylesheet with its XML output. The
xml\-stylesheet
directive is omitted.
.SH "MISCELLANEOUS OPTIONS"
.PP
This section describes some important (and not\-so\-important) options that don't really fit anywhere else.
.TP
\fB\-6\fR (Enable IPv6 scanning)
Since 2002, Nmap has offered IPv6 support for its most popular features. In particular, ping scanning (TCP\-only), connect scanning, and version detection all support IPv6. The command syntax is the same as usual except that you also add the
\fB\-6\fR
option. Of course, you must use IPv6 syntax if you specify an address rather than a hostname. An address might look like
3ffe:7501:4819:2000:210:f3ff:fe03:14d0, so hostnames are recommended. The output looks the same as usual, with the IPv6 address on the
\(lqinteresting ports\(rq
line being the only IPv6 give away.
.sp
While IPv6 hasn't exactly taken the world by storm, it gets significant use in some (usually Asian) countries and most modern operating systems support it. To use Nmap with IPv6, both the source and target of your scan must be configured for IPv6. If your ISP (like most of them) does not allocate IPv6 addresses to you, free tunnel brokers are widely available and work fine with Nmap. One of the better ones is run by BT Exact at
\fI\%https://tb.ipv6.btexact.com/\fR. I have also used one that Hurricane Electric provides at
\fI\%http://ipv6tb.he.net/\fR. 6to4 tunnels are another popular, free approach.
.TP
\fB\-A\fR (Aggressive scan options)
This option enables additional advanced and aggressive options. I haven't decided exactly which it stands for yet. Presently this enables OS Detection (\fB\-O\fR) and version scanning (\fB\-sV\fR). More features may be added in the future. The point is to enable a comprehensive set of scan options without people having to remember a large set of flags. This option only enables features, and not timing options (such as
\fB\-T4\fR) or verbosity options (\fB\-v\fR) that you might want as well.
.TP
\fB\-\-datadir <directoryname>\fR (Specify custom Nmap data file location)
Nmap obtains some special data at runtime in files named
\fInmap\-service\-probes\fR,
\fInmap\-services\fR,
\fInmap\-protocols\fR,
\fInmap\-rpc\fR,
\fInmap\-mac\-prefixes\fR, and
\fInmap\-os\-fingerprints\fR. Nmap first searches these files in the directory specified with the
\fB\-\-datadir\fR
option (if any). Any files not found there, are searched for in the directory specified by the NMAPDIR environmental variable. Next comes
\fI~/.nmap\fR
for real and effective UIDs (POSIX systems only) or location of the Nmap executable (Win32 only), and then a compiled\-in location such as
\fI/usr/local/share/nmap\fR
or
\fI/usr/share/nmap\fR
. As a last resort, Nmap will look in the current directory.
.TP
\fB\-\-send\-eth\fR (Use raw ethernet sending)
Asks Nmap to send packets at the raw ethernet (data link) layer rather than the higher IP (network) layer. By default, Nmap chooses the one which is generally best for the platform it is running on. Raw sockets (IP layer) are generally most efficient for UNIX machines, while ethernet frames are required for Windows operation since Microsoft disabled raw socket support. Nmap still uses raw IP packets on UNIX despite this option when there is no other choice (such as non\-ethernet connections).
.TP
\fB\-\-send\-ip\fR (Send at raw IP level)
Asks Nmap to send packets via raw IP sockets rather than sending lower level ethernet frames. It is the complement to the
\fB\-\-send\-eth\fR
option discussed previously.
.TP
\fB\-\-privileged\fR (Assume that the user is fully privileged)
Tells Nmap to simply assume that it is privileged enough to perform raw socket sends, packet sniffing, and similar operations that usually require root privileges on UNIX systems. By default Nmap quits if such operations are requested but geteuid() is not zero.
\fB\-\-privileged\fR
is useful with Linux kernel capabilities and similar systems that may be configured to allow unprivileged users to perform raw\-packet scans. Be sure to provide this option flag before any flags for options that require privileges (SYN scan, OS detection, etc.). The NMAP_PRIVILEGED variable may be set as an equivalent alternative to
\fB\-\-privileged\fR.
.TP
\fB\-\-interactive\fR (Start in interactive mode)
Starts Nmap in interactive mode, which offers an interactive Nmap prompt allowing easy launching of multiple scans (either synchronously or in the background). This is useful for people who scan from multi\-user systems as they often want to test their security without letting everyone else on the system know exactly which systems they are scanning. Use
\fB\-\-interactive\fR
to activate this mode and then type
h
for help. This option is rarely used because proper shells are usually more familiar and feature\-complete. This option includes a bang (!) operator for executing shell commands, which is one of many reasons not to install Nmap setuid root.
.TP
\fB\-V\fR; \fB\-\-version\fR (Print version number)
Prints the Nmap version number and exits.
.TP
\fB\-h\fR; \fB\-\-help\fR (Print help summary page)
Prints a short help screen with the most common command flags. Running Nmap without any arguments does the same thing.
.SH "RUNTIME INTERACTION"
.PP
During the execution of nmap, all key presses are captured. This allows you to interact with the program without aborting and restarting it. Certain special keys will change options, while any other keys will print out a status message telling you about the scan. The convention is that
\fIlowercase letters increase\fR
the amount of printing, and
\fIuppercase letters decrease\fR
the printing. You may also press \(oq\fI?\fR\(cq for help.
.TP
\fBv\fR / \fBV\fR
Increase / Decrease the Verbosity
.TP
\fBd\fR / \fBD\fR
Increase / Decrease the Debugging Level
.TP
\fBp\fR / \fBP\fR
Turn on / off Packet Tracing
.TP
\fB?\fR
Print a runtime interaction help screen
.TP
Anything else
Print out a status message like this:
.sp
Stats: 0:00:08 elapsed; 111 hosts completed (5 up), 5 undergoing Service Scan
.sp
Service scan Timing: About 28.00% done; ETC: 16:18 (0:00:15 remaining)
.SH "EXAMPLES"
.PP
Here are some Nmap usage examples, from the simple and routine to a little more complex and esoteric. Some actual IP addresses and domain names are used to make things more concrete. In their place you should substitute addresses/names from
\fIyour own network.\fR. While I don't think port scanning other networks is or should be illegal, some network administrators don't appreciate unsolicited scanning of their networks and may complain. Getting permission first is the best approach.
.PP
For testing purposes, you have permission to scan the host
scanme.nmap.org. This permission only includes scanning via Nmap and not testing exploits or denial of service attacks. To conserve bandwidth, please do not initiate more than a dozen scans against that host per day. If this free scanning target service is abused, it will be taken down and Nmap will report
Failed to resolve given hostname/IP: scanme.nmap.org. These permissions also apply to the hosts
scanme2.nmap.org,
scanme3.nmap.org, and so on, though those hosts do not currently exist.
.PP
\fBnmap \-v scanme.nmap.org\fR
.PP
This option scans all reserved TCP ports on the machine
scanme.nmap.org
. The
\fB\-v\fR
option enables verbose mode.
.PP
\fBnmap \-sS \-O scanme.nmap.org/24\fR
.PP
Launches a stealth SYN scan against each machine that is up out of the 255 machines on
\(lqclass C\(rq
network where Scanme resides. It also tries to determine what operating system is running on each host that is up and running. This requires root privileges because of the SYN scan and OS detection.
.PP
\fBnmap \-sV \-p 22,53,110,143,4564 198.116.0\-255.1\-127\fR
.PP
Launches host enumeration and a TCP scan at the first half of each of the 255 possible 8 bit subnets in the 198.116 class B address space. This tests whether the systems run sshd, DNS, pop3d, imapd, or port 4564. For any of these ports found open, version detection is used to determine what application is running.
.PP
\fBnmap \-v \-iR 100000 \-P0 \-p 80\fR
.PP
Asks Nmap to choose 100,000 hosts at random and scan them for web servers (port 80). Host enumeration is disabled with
\fB\-P0\fR
since first sending a couple probes to determine whether a host is up is wasteful when you are only probing one port on each target host anyway.
.PP
\fBnmap \-P0 \-p80 \-oX logs/pb\-port80scan.xml \-oG logs/pb\-port80scan.gnmap 216.163.128.20/20\fR
.PP
This scans 4096 IPs for any webservers (without pinging them) and saves the output in grepable and XML formats.
.SH "BUGS"
.PP
Like its author, Nmap isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nmap doesn't behave the way you expect, first upgrade to the latest version available from
\fI\%http://www.insecure.org/nmap/\fR. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try Googling the error message or browsing the Nmap\-dev archives at
\fI\%http://seclists.org/\fR. Read this full munaual page as well. If nothing comes of this, mail a bug report to
<nmap\-dev@insecure.org>. Please include everything you have learned about the problem, as well as what version of Nmap you are running and what operating system version it is running on. Problem reports and Nmap usage questions sent to nmap\-dev@insecure.org are far more likely to be answered than those sent to Fyodor directly.
.PP
Code patches to fix bugs are even better than bug reports. Basic instructions for creating patch files with your changes are available at
\fI\%http://www.insecure.org/nmap/data/HACKING\fR. Patches may be sent to nmap\-dev (recommended) or to Fyodor directly.
.SH "AUTHOR"
.PP
Fyodor
<fyodor@insecure.org>
(\fI\%http://www.insecure.org\fR)
.PP
Hundreds of people have made valuable contributions to Nmap over the years. These are detailed in the
\fICHANGELOG\fR
file which is distributed with Nmap and also available from
\fI\%http://www.insecure.org/nmap/changelog.html\fR.
.SH "LEGAL NOTICES"
.SS "Nmap Copyright and Licensing"
.PP
The Nmap Security Scanner is (C) 1996\-2005 Insecure.Com LLC. Nmap is also a registered trademark of Insecure.Com LLC. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed Nmap technology into proprietary software, we may be willing to sell alternative licenses (contact
<sales@insecure.com>). Many security scanner vendors already license Nmap technology such as host discovery, port scanning, OS detection, and service/version detection.
.PP
Note that the GPL places important restrictions on
\(lqderived works\(rq, yet it does not provide a detailed definition of that term. To avoid misunderstandings, we consider an application to constitute a
\(lqderivative work\(rq
for the purpose of this license if it does any of the following:
.TP 3
\(bu
Integrates source code from Nmap
.TP
\(bu
Reads or includes Nmap copyrighted data files, such as
\fInmap\-os\-fingerprints\fR
or
\fInmap\-service\-probes\fR.
.TP
\(bu
Executes Nmap and parses the results (as opposed to typical shell or execution\-menu apps, which simply display raw Nmap output and so are not derivative works.)
.TP
\(bu
Integrates/includes/aggregates Nmap into a proprietary executable installer, such as those produced by InstallShield.
.TP
\(bu
Links to a library or executes a program that does any of the above.
.PP
The term
\(lqNmap\(rq
should be taken to also include any portions or derived works of Nmap. This list is not exclusive, but is just meant to clarify our interpretation of derived works with some common examples. These restrictions only apply when you actually redistribute Nmap. For example, nothing stops you from writing and selling a proprietary front\-end to Nmap. Just distribute it by itself, and point people to
\fI\%http://www.insecure.org/nmap/\fR
to download Nmap.
.PP
We don't consider these to be added restrictions on top of the GPL, but just a clarification of how we interpret
\(lqderived works\(rq
as it applies to our GPL\-licensed Nmap product. This is similar to the way Linus Torvalds has announced his interpretation of how
\(lqderived works\(rq
applies to Linux kernel modules. Our interpretation refers only to Nmap \- we don't speak for any other GPL products.
.PP
If you have any questions about the GPL licensing restrictions on using Nmap in non\-GPL works, we would be happy to help. As mentioned above, we also offer alternative license to integrate Nmap into proprietary applications and appliances. These contracts have been sold to many security vendors, and generally include a perpetual license as well as providing for priority support and updates as well as helping to fund the continued development of Nmap technology. Please email
<sales@insecure.com>
for further information.
.PP
As a special exception to the GPL terms, Insecure.Com LLC grants permission to link the code of this program with any version of the OpenSSL library which is distributed under a license identical to that listed in the included Copying.OpenSSL file, and distribute linked combinations including the two. You must obey the GNU GPL in all respects for all of the code used other than OpenSSL. If you modify this file, you may extend this exception to your version of the file, but you are not obligated to do so.
.PP
If you received these files with a written license agreement or contract stating terms other than the terms above, then that alternative license agreement takes precedence over these comments.
.SS "Creative Commons license for this Nmap guide"
.PP
This Nmap Reference Guide is (C) 2005 Insecure.Com LLC. It is hereby placed under version 2.5 of the
[8]\&\fICreative Commons Attribution License\fR. This allows you redistribute and modify the work as you desire, as long as you credit the original source. Alternatively, you may choose to treat this document as falling under the same license as Nmap itself (discussed previously).
.SS "Source code availability and community contributions"
.PP
Source is provided to this software because we believe users have a right to know exactly what a program is going to do before they run it. This also allows you to audit the software for security holes (none have been found so far).
.PP
Source code also allows you to port Nmap to new platforms, fix bugs, and add new features. You are highly encouraged to send your changes to
<fyodor@insecure.org>
for possible incorporation into the main distribution. By sending these changes to Fyodor or one of the Insecure.Org development mailing lists, it is assumed that you are offering Fyodor and Insecure.Com LLC the unlimited, non\-exclusive right to reuse, modify, and relicense the code. Nmap will always be available Open Source, but this is important because the inability to relicense code has caused devastating problems for other Free Software projects (such as KDE and NASM). We also occasionally relicense the code to third parties as discussed above. If you wish to specify special license conditions of your contributions, just say so when you send them.
.SS "No Warranty"
.PP
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details at
\fI\%http://www.gnu.org/copyleft/gpl.html\fR, or in the COPYING file included with Nmap.
.PP
It should also be noted that Nmap has occasionally been known to crash poorly written applications, TCP/IP stacks, and even operating systems. While this is extremely rare, it is important to keep in mind.
\fINmap should never be run against mission critical systems\fR
unless you are prepared to suffer downtime. We acknowledge here that Nmap may crash your systems or networks and we disclaim all liability for any damage or problems Nmap could cause.
.SS "Inappropriate Usage"
.PP
Because of the slight risk of crashes and because a few black hats like to use Nmap for reconnaissance prior to attacking systems, there are administrators who become upset and may complain when their system is scanned. Thus, it is often advisable to request permission before doing even a light scan of a network.
.PP
Nmap should never be installed with special privileges (e.g. suid root) for security reasons.
.SS "Third\-Party Software"
.PP
This product includes software developed by the
[9]\&\fIApache Software Foundation\fR. A modified version of the
[10]\&\fILibpcap portable packet capture library\fR
is distributed along with nmap. The Windows version of Nmap utilized the libpcap\-derived
[11]\&\fIWinPcap library\fR
instead. Regular expression support is provided by the
[12]\&\fIPCRE library\fR, which is open source software, written by Philip Hazel. Certain raw networking functions use the
[13]\&\fILibdnet\fR
networking library, which was written by Dug Song. A modified version is distributed with Nmap. Nmap can optionally link with the
[14]\&\fIOpenSSL cryptography toolkit\fR
for SSL version detection support. All of the third\-party software described in this paragraph is freely redistributable under BSD\-style software licenses.
.SS "US Export Control Classification"
.PP
US Export Control: Insecure.Com LLC believes that Nmap falls under US ECCN (export control classification number) 5D992. This category is called
\(lqInformation Security software not controlled by 5D002\(rq. The only restriction of this classification is AT (anti\-terrorism), which applies to almost all goods and denies export to a handful of rogue nations such as Iran and North Korea. Thus exporting Nmap does not require any special license, permit, or other governmental authorization.
.SH "REFERENCES"
.TP 4
 1.\ RFC 1122
\%http://www.rfc\-editor.org/rfc/rfc1122.txt
.TP 4
 2.\ RFC 792
\%http://www.rfc\-editor.org/rfc/rfc792.txt
.TP 4
 3.\ UDP
\%http://www.rfc\-editor.org/rfc/rfc768.txt
.TP 4
 4.\ TCP RFC
\%http://www.rfc\-editor.org/rfc/rfc793.txt
.TP 4
 5.\ RFC 959
\%http://www.rfc\-editor.org/rfc/rfc959.txt
.TP 4
 6.\ Nmap::Scanner
\%http://sourceforge.net/projects/nmap\-scanner/
.TP 4
 7.\ Nmap::Parser
\%http://www.nmapparser.com
.TP 4
 8.\ Creative Commons Attribution License
\%http://creativecommons.org/licenses/by/2.5/
.TP 4
 9.\ Apache Software Foundation
\%http://www.apache.org
.TP 4
10.\ Libpcap portable packet capture library
\%http://www.tcpdump.org
.TP 4
11.\ WinPcap library
\%http://www.winpcap.org
.TP 4
12.\ PCRE library
\%http://www.pcre.org
.TP 4
13.\ Libdnet
\%http://libdnet.sourceforge.net
.TP 4
14.\ OpenSSL cryptography toolkit
\%http://www.openssl.org
  07070100243fea000081a40000000a0000000a0000000144fe8f2700001e84000000880000000a00000000000000000000001d00000005reloc/doc/nmap/docs/nmap.dtd  <!--
    nmap.dtd
    This is the DTD for nmap's XML output (-oX) format.
    $Id: nmap.dtd 3437 2006-06-10 21:23:27Z fyodor $

    Originally written by:
    William McVey <wam@cisco.com> <wam+nmap@wamber.net>

    Now maintained by Fyodor <fyodor@insecure.org> as part of Nmap.     

    To validate using this file, simply add a DOCTYPE line similar to:
    <!DOCTYPE nmaprun SYSTEM "nmap.dtd">
    to the nmap output immediately below the prologue (the first line).  This
    should allow you to run a validating parser against the output (so long
    as the dtd is in your parser's dtd search path).

    Bugs:
    Most of the elements are "locked" into the specific order that nmap
    generates, when there really is no need for a specific ordering.
    This is primarily because I don't know the xml DTD construct to
    specify "one each of this list of elements, in any order".  If there
    is a construct similar to SGML's '&' operator, please let me know.

    Portions Copyright (c) 2001-2005 Insecure.Com LLC
    Portions Copyright (c) 2001 by Cisco systems, Inc.
 
    Permission to use, copy, modify, and distribute modified and
    unmodified copies of this software for any purpose and without fee is
    hereby granted, provided that (a) this copyright and permission notice
    appear on all copies of the software and supporting documentation, (b)
    the name of Cisco Systems, Inc. not be used in advertising or
    publicity pertaining to distribution of the program without specific
    prior permission, and (c) notice be given in supporting documentation
    that use, modification, copying and distribution is by permission of
    Cisco Systems, Inc.
 
    Cisco Systems, Inc. makes no representations about the suitability
    of this software for any purpose.  THIS SOFTWARE IS PROVIDED ``AS
    IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
    WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
    FITNESS FOR A PARTICULAR PURPOSE.
-->

<!-- parameter entities to specify common "types" used elsewhere in the DTD -->
<!ENTITY % attr_numeric "CDATA" >
<!ENTITY % attr_ipaddr "CDATA" >
<!ENTITY % attr_numeric "CDATA" >
<!ENTITY % attr_type "(ipv4 | ipv6 | mac)" >

<!ENTITY % host_states "(up|down|unknown|skipped)" >

<!-- see: nmap.c:statenum2str for list of port states -->
<!-- Maybe they should be enumerated as in scan_types below , but I -->
<!-- don't know how to escape states like open|filtered -->
<!ENTITY % port_states "CDATA" >

<!ENTITY % hostname_types "(PTR)" >

<!-- see output.c:output_xml_scaninfo_records for scan types -->
<!ENTITY % scan_types "(syn|ack|bounce|connect|null|xmas|window|maimon|fin|udp|ipproto)" >

<!-- <!ENTITY % ip_versions "(ipv4)" > -->

<!ENTITY % port_protocols "(ip|tcp|udp)" >

<!-- I don't know exactly what these are, but the values were enumerated via:
     grep "conf=" *
--> 
<!ENTITY % service_confs  "( 0 | 3 | 5 | 10)" >

<!-- This element was started in nmap.c:nmap_main().
     It represents to the topmost element of the output document.
-->
<!ELEMENT nmaprun      (scaninfo*, verbose, debugging, host*, runstats) >
<!ATTLIST nmaprun
			scanner		(nmap)		#REQUIRED
			args		CDATA		#IMPLIED
			start		%attr_numeric;	#IMPLIED
			startstr	CDATA	        #IMPLIED
			version		CDATA		#REQUIRED
			xmloutputversion (1.01)		#REQUIRED
>

<!-- this element is written in output.c:doscaninfo() -->
<!ELEMENT scaninfo	EMPTY >
<!ATTLIST scaninfo
			type		%scan_types;	#REQUIRED
			protocol	%port_protocols; #REQUIRED
			numservices	%attr_numeric;	#REQUIRED
			services	CDATA		#REQUIRED
>

<!-- these elements are written in nmap.c:nmap_main() -->
<!ELEMENT verbose	EMPTY >
<!ATTLIST verbose	level		%attr_numeric;	#IMPLIED >


<!ELEMENT debugging 	EMPTY >
<!ATTLIST debugging	level		%attr_numeric;	#IMPLIED >

<!-- 
     this element is started in nmap.c:nmap_main() and filled by
     output.c:write_host_status(), output.c:printportoutput(), and
     output.c:printosscanoutput()
-->
<!ELEMENT host		( status, address , (address | hostnames |
                          smurf | ports | os | uptime | 
                          tcpsequence | ipidsequence | tcptssequence )* ) >


<!-- these elements are written by output.c:write_xml_initial_hostinfo() -->
<!ELEMENT status	EMPTY >
<!ATTLIST status	state		%host_states;	#REQUIRED >

<!ELEMENT address	EMPTY >
<!ATTLIST address	
			addr		%attr_ipaddr;	#REQUIRED
			addrtype	%attr_type;	"ipv4"
			vendor		CDATA		#IMPLIED
>

<!ELEMENT hostnames	(hostname)* >
<!ELEMENT hostname	EMPTY >
<!ATTLIST hostname
			name		CDATA		#IMPLIED
			type		%hostname_types; #IMPLIED
>


<!-- this element is written by output.c:write_host_status() -->
<!ELEMENT smurf		EMPTY >
<!ATTLIST smurf		responses	%attr_numeric;	#REQUIRED >

<!-- these elements are written by output.c:printportoutput() -->

<!ELEMENT ports		(extraports* , port*) >

<!ELEMENT extraports	EMPTY >
<!ATTLIST extraports
			state		%port_states;	#REQUIRED
			count		%attr_numeric;  #REQUIRED	
>

<!ELEMENT port		(state , owner? , service? ) >
<!ATTLIST port
			protocol	%port_protocols;	#REQUIRED
			portid		%attr_numeric;	#REQUIRED
>

<!ELEMENT state		EMPTY >
<!ATTLIST state		state		%port_states;	#REQUIRED >

<!ELEMENT owner		EMPTY >
<!ATTLIST owner		name		CDATA		#REQUIRED >

<!ELEMENT service	EMPTY >
<!ATTLIST service
			name		CDATA		#REQUIRED
			conf		%service_confs;	#REQUIRED
                        method          (table|detection|probed) #REQUIRED
                        version         CDATA           #IMPLIED
                        product         CDATA           #IMPLIED
                        extrainfo       CDATA           #IMPLIED
			tunnel		(ssl)		#IMPLIED
			proto		(rpc)		#IMPLIED
			rpcnum		%attr_numeric;	#IMPLIED
			lowver		%attr_numeric;	#IMPLIED
			highver		%attr_numeric;	#IMPLIED
                        hostname        CDATA           #IMPLIED
                        ostype          CDATA           #IMPLIED
                        devicetype      CDATA           #IMPLIED
                        servicefp       CDATA           #IMPLIED
>

<!ELEMENT os		( portused* , osclass*, osmatch*, osfingerprint* ) >

<!ELEMENT portused	EMPTY >
<!ATTLIST portused
			state 		%port_states;	#REQUIRED
			proto 		%port_protocols; #REQUIRED
			portid 		%attr_numeric;	#REQUIRED
>
<!ELEMENT osclass      EMPTY >
<!ATTLIST osclass
                       vendor          CDATA           #REQUIRED
                       osgen           CDATA           #IMPLIED
                       type            CDATA           #IMPLIED
                       accuracy        CDATA           #REQUIRED
                       osfamily        CDATA           #REQUIRED
>


<!ELEMENT osmatch	EMPTY >
<!ATTLIST osmatch
			name		CDATA		#REQUIRED
			accuracy	%attr_numeric;	#REQUIRED
			line    	%attr_numeric;	#REQUIRED
>

<!ELEMENT osfingerprint	EMPTY >
<!ATTLIST osfingerprint
			fingerprint	CDATA		#REQUIRED
>

<!ELEMENT uptime	EMPTY >
<!ATTLIST uptime
			seconds		%attr_numeric;	#REQUIRED
			lastboot	CDATA		#IMPLIED
>

<!ELEMENT tcpsequence	EMPTY >
<!ATTLIST tcpsequence
			index		%attr_numeric;	#REQUIRED
			class		CDATA		#REQUIRED
			difficulty	CDATA		#REQUIRED
			values		CDATA		#REQUIRED
>

<!ELEMENT ipidsequence	EMPTY >
<!ATTLIST ipidsequence
			class		CDATA		#REQUIRED
			values		CDATA		#REQUIRED
>

<!ELEMENT tcptssequence	EMPTY >
<!ATTLIST tcptssequence
			class		CDATA		#REQUIRED
			values		CDATA		#IMPLIED
>

<!-- these elements are generated in output.c:printfinaloutput() -->
<!ELEMENT runstats	(finished, hosts) >

<!ELEMENT finished	EMPTY >
<!ATTLIST finished	time		%attr_numeric;	#REQUIRED 
                        timestr		CDATA	        #IMPLIED
>

<!ELEMENT hosts		EMPTY >
<!ATTLIST hosts
			up		%attr_numeric;	"0"
			down		%attr_numeric;	"0"
			total		%attr_numeric;	#REQUIRED
>
07070100243feb000081a40000000a0000000a0000000144fe8f2600001191000000880000000a00000000000000000000002300000005reloc/doc/nmap/docs/nmap.usage.txt    Nmap 4.11 ( http://www.insecure.org/nmap/ )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sP: Ping Scan - go no further than determining if host is online
  -P0: Treat all hosts as online -- skip host discovery
  -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idlescan
  -sO: IP protocol scan
  -b <ftp relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
  -F: Fast - Scan only the ports listed in the nmap-services file)
  -r: Scan ports consecutively - don't randomize
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in milliseconds, unless you append 's'
  (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T[0-5]: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <time>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --data-length <num>: Append random data to sent packets
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use twice for more effect)
  -d[level]: Set or increase debugging level (Up to 9 is meaningful)
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --log-errors: Log errors/warnings to the normal-format output file
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Insecure.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enables OS detection and Version detection
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sP 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -P0 -p 80
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
   07070100243fec000081a40000000a0000000a0000000144fe8f2700005430000000880000000a00000000000000000000001d00000005reloc/doc/nmap/docs/nmap.xsl  <?xml version="1.0" encoding="UTF-8"?>
<!-- =========================================================================
            nmap.xsl stylesheet version 0.9b
            last change: 2006-03-04
            Benjamin Erb, http://www.benjamin-erb.de
==============================================================================
    Copyright (c) 2004-2006 Benjamin Erb
    All rights reserved.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions
    are met:
    1. Redistributions of source code must retain the above copyright
       notice, this list of conditions and the following disclaimer.
    2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.
    3. The name of the author may not be used to endorse or promote products
       derived from this software without specific prior written permission.

    THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
    IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
    OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
    IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
    INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
    NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
    THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
    (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
    THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
========================================================================== -->
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:fo="http://www.w3.org/1999/XSL/Format">
<xsl:output method="html" indent="yes" encoding="UTF-8" />

<!-- global variables      -->
<!-- ............................................................ -->
<xsl:variable name="nmap_xsl_version">0.9b</xsl:variable>
<!-- ............................................................ -->
<xsl:variable name="start"><xsl:value-of select="/nmaprun/@startstr" /></xsl:variable>
<xsl:variable name="end"><xsl:value-of select="/nmaprun/runstats/finished/@timestr" /> </xsl:variable>
<xsl:variable name="totaltime"><xsl:value-of select="/nmaprun/runstats/finished/@time -/nmaprun/@start" /></xsl:variable>
<!-- ............................................................ -->


<xsl:template match="/">
	<xsl:apply-templates/>
</xsl:template>


<!-- root -->
<!-- ............................................................ -->
<xsl:template match="/nmaprun">
<html>
<head>

<xsl:comment>generated with nmap.xsl - version <xsl:value-of select="$nmap_xsl_version" /> by Benjamin Erb - http://www.benjamin-erb.de/nmap_xsl.php </xsl:comment>

<style type="text/css">
/* stylesheet print */
@media print
{
	#menu
	{
		display:none;
	}

	h1
	{
    	font-size: 13pt;
    	font-weight:bold;
    	margin:4pt 0pt 0pt 0pt;
    	padding:0;
	}

	h2
	{
    	font-size: 12pt;
    	font-weight:bold;
    	margin:3pt 0pt 0pt 0pt;
    	padding:0;
	}
	h3
	{
    	font-size: 9pt;
    	font-weight:bold;
    	margin:1pt 0pt 0pt 20pt;
    	padding:0;
	}

	p,ul
	{
    	font-size: 9pt;
    	margin:1pt 0pt 8pt 40pt;
    	padding:0;
    	text-align:left;

	}

	li
	{
    	font-size: 9pt;
    	margin:0;
    	padding:0;
    	text-align:left;

	}

	table
	{
    	margin:1pt 0pt 8pt 40pt;
    	border:0px;
    	width:90%
	}

	td
	{
    	border:0px;
    	border-top:1px solid black;
    	font-size: 9pt;
	}

	.head td
	{
		border:0px;
    	font-weight:bold;
    	font-size: 9pt;
	}


}

/* stylesheet screen */
@media screen
{
    body
    {
    	margin: 0px;
    	background-color: #FFFFFF;
    	color: #000000;
    	text-align: center;
    }

    #container
    {
        text-align:left;
        margin: 10px auto;
        width: 90%;
    }

    h1
    {
    	font-family: Verdana, Helvetica, sans-serif;
    	font-weight:bold;
    	font-size: 14pt;
    	color: #000000;
        background-color:#87CEFA;
        margin:10px 0px 0px 0px;
        padding:5px 4px 5px 4px;
        width: 100%;
        border:1px solid black;
        text-align: left;
    }

    h2
    {
        font-family: Verdana, Helvetica, sans-serif;
        font-weight:bold;
        font-size: 11pt;
        color: #000000;
        margin:30px 0px 0px 0px;
        padding:4px;
        width: 100%;
        border:1px solid black;
        background-color:#F0F8FF;
        text-align: left;
    }

    h2.green
    {
        color: #000000;
        background-color:#CCFFCC;
        border-color:#006400;
    }

    h2.red
    {
        color: #000000;
        background-color:#FFCCCC;
        border-color:#8B0000;
    }
   
    h3
    {
        font-family: Verdana, Helvetica, sans-serif;
        font-weight:bold;
        font-size: 10pt;
        color:#000000;
        background-color: #FFFFFF;
        width: 75%;
        text-align: left;
    }

    p
    {
        font-family: Verdana, Helvetica, sans-serif;
        font-size: 8pt;
        color:#000000;
        background-color: #FFFFFF;
        width: 75%;
        text-align: left;
    }

    p i
    {
        font-family: "Courier New", Courier, mono;
        font-size: 8pt;
        color:#000000;
        background-color: #CCCCCC;
    }

    ul
    {
        font-family: Verdana, Helvetica, sans-serif;
        font-size: 8pt;
        color:#000000;
        background-color: #FFFFFF;
        width: 75%;
        text-align: left;
    }

    a
    {
        font-family: Verdana, Helvetica, sans-serif;
        text-decoration: none;
        font-size: 8pt;
        color:#000000;
        font-weight:bold;
        background-color: #FFFFFF;
        color: #000000;
    }

    li a
    {
        font-family: Verdana, Helvetica, sans-serif;
        text-decoration: none;
        font-size: 10pt;
        color:#000000;
        font-weight:bold;
        background-color: #FFFFFF;
        color: #000000;
    }

    a:hover
    {
	    text-decoration: underline;
    }

    a.red
    {
        color:#8B0000;
    }
    a.green
    {
        color:#006400;
    }

    table
    {
        width: 80%;
        border:0px;
        color: #000000;
        background-color: #000000;
        margin:10px;
    }

    tr
    {
        vertical-align:top;
        font-family: Verdana, Helvetica, sans-serif;
        font-size: 8pt;
        color:#000000;
        background-color: #D1D1D1;
    }

    tr.head
    {
        background-color: #E1E1E1;
        color: #000000;
        font-weight:bold;
    }

    tr.open
    {
        background-color: #CCFFCC;
        color: #000000;
    }

    tr.filtered
    {
        background-color: #FFDDBB;
        color: #000000;
    }

    tr.closed
    {
        background-color: #FFAFAF;
        color: #000000;
    }
    
    td
    {
        padding:2px;
    }
    
    .status
    {
        display:none;
    }
    
    #menu li
    {
        display         : inline;
        margin          : 0;
        /*margin-right    : 10px;*/
        padding         : 0;
        list-style-type : none;
    }    
}
</style>
	<title>nmap report</title>
</head>

<body>
	<div id="container">
    <h1>nmap scan report - scan @ <xsl:value-of select="$start" />
    </h1>
    
    <ul id="menu">
    	<li><a href="#scansummary">scan summary</a><xsl:text> | </xsl:text></li>
    	<li><a href="#scaninfo">scan info</a><xsl:text> | </xsl:text></li>

          <xsl:for-each select="host">
              <xsl:sort select="substring ( address/@addr, 1, string-length ( substring-before ( address/@addr, '.' ) ) )* (256*256*256) + substring ( substring-after ( address/@addr, '.' ), 1, string-length ( substring-before ( substring-after ( address/@addr, '.' ), '.' ) ) )* (256*256) + substring ( substring-after ( substring-after ( address/@addr, '.' ), '.' ), 1, string-length ( substring-before ( substring-after ( substring-after ( address/@addr, '.' ), '.' ), '.' ) ) ) * 256 + substring ( substring-after ( substring-after ( substring-after ( address/@addr, '.' ), '.' ), '.' ), 1 )" order="ascending" data-type="number"/>
              <li>
                <xsl:element name="a">
                    <xsl:attribute name="href">#<xsl:value-of select="translate(address/@addr, '.', '_') " /></xsl:attribute>
                    <xsl:attribute name="class">
                	<xsl:choose>
                        <xsl:when test="status/@state = 'up'">green</xsl:when>
                        <xsl:otherwise>red</xsl:otherwise>                    
                	</xsl:choose>
                    </xsl:attribute>
                    <xsl:value-of select="address/@addr"/>
                    <xsl:if test="count(hostnames/hostname) > 0">
                      <xsl:for-each select="hostnames/hostname">
                        <xsl:sort select="@name" order="ascending" data-type="text"/>
                        <xsl:text> / </xsl:text><xsl:value-of select="@name"/>
                      </xsl:for-each>                          
                    </xsl:if>                                
                </xsl:element>
               <xsl:text> | </xsl:text></li>
          </xsl:for-each>

        <li><a href="#runstats">runstats</a></li>
    </ul>
  
	<xsl:element name="a">
		<xsl:attribute name="name">scansummary</xsl:attribute>
	</xsl:element>
    <h2>scan summary</h2>
    <p>
	<xsl:value-of select="@scanner"/> was initiated at <xsl:value-of select="$start" /> with these arguments:<br/>
    <i><xsl:value-of select="@args" /></i><br/>
    The process stopped at <xsl:value-of select="$end" />.
	<xsl:choose>
        <xsl:when test="debugging/@level = '0'">Debuging was disabled, </xsl:when>
        <xsl:otherwise>Debugging was enabeld, </xsl:otherwise>
    </xsl:choose>
    the verbosity level was <xsl:value-of select="verbose/@level" />.

    </p>
    <xsl:apply-templates select="host">
        <xsl:sort select="substring ( address/@addr, 1, string-length ( substring-before ( address/@addr, '.' ) ) )* (256*256*256) + substring ( substring-after ( address/@addr, '.' ), 1, string-length ( substring-before ( substring-after ( address/@addr, '.' ), '.' ) ) )* (256*256) + substring ( substring-after ( substring-after ( address/@addr, '.' ), '.' ), 1, string-length ( substring-before ( substring-after ( substring-after ( address/@addr, '.' ), '.' ), '.' ) ) ) * 256 + substring ( substring-after ( substring-after ( substring-after ( address/@addr, '.' ), '.' ), '.' ), 1 )" order="ascending" data-type="number"/>
    </xsl:apply-templates>	
    <xsl:apply-templates select="runstats"/>
    </div>
    
</body>
</html>
</xsl:template>
<!-- ............................................................ -->

<!-- scaninfo -->
<!-- ............................................................ -->
<xsl:template match="scaninfo">
	<xsl:element name="a">
		<xsl:attribute name="name">scaninfo</xsl:attribute>
	</xsl:element>

	<h2>scan info</h2>
	<ul>
        <li><xsl:value-of select="@type" />-scan</li>
        <li><xsl:value-of select="@numservices" /><xsl:text> </xsl:text><xsl:value-of select="@protocol" /> services scanned</li>
	</ul>
	<xsl:apply-templates/>
</xsl:template>
<!-- ............................................................ -->

<!-- runstats -->
<!-- ............................................................ -->
<xsl:template match="runstats">
	<xsl:element name="a">
		<xsl:attribute name="name">runstats</xsl:attribute>
	</xsl:element>

	<h2>runstats</h2>
	<ul>
		<li><xsl:value-of select="$totaltime" /> sec. scanned</li>
        <li><xsl:value-of select="hosts/@total" /> host(s) scanned</li>
        <li><xsl:value-of select="hosts/@up" /> host(s) online</li>
        <li><xsl:value-of select="hosts/@down" /> host(s) offline</li>
	</ul>
	<ul>
		<li>nmap version: <xsl:value-of select="/nmaprun/@version" /></li>
        <li>xml output version: <xsl:value-of select="/nmaprun/@xmloutputversion" /></li>
        <li>nmap.xsl version: <xsl:value-of select="$nmap_xsl_version" /></li>
	</ul>
	<xsl:apply-templates/>
</xsl:template>
<!-- ............................................................ -->

<!-- host -->
<!-- ............................................................ -->
<xsl:template match="host">
	<xsl:element name="a">
		<xsl:attribute name="name"><xsl:value-of select="translate(address/@addr, '.', '_') " /></xsl:attribute>
	</xsl:element>

    <xsl:choose>
        <xsl:when test="status/@state = 'up'">
            <h2 class="green"><xsl:value-of select="address/@addr"/>
            <xsl:if test="count(hostnames/hostname) > 0">
              <xsl:for-each select="hostnames/hostname">
                <xsl:sort select="@name" order="ascending" data-type="text"/>
                <xsl:text> / </xsl:text><xsl:value-of select="@name"/>
              </xsl:for-each>                          
            </xsl:if>
            <span class="status">(online)</span>
            </h2>
        </xsl:when>
        <xsl:otherwise>
            <h2 class="red"><xsl:value-of select="address/@addr"/>
            <xsl:if test="count(hostnames/hostname) > 0">
              <xsl:for-each select="hostnames/hostname">
                <xsl:sort select="@name" order="ascending" data-type="text"/>
                <xsl:text> / </xsl:text><xsl:value-of select="@name"/>
              </xsl:for-each>            
            </xsl:if>             
            <span class="status">(offline)</span></h2>
        </xsl:otherwise>
    </xsl:choose>

    <xsl:if test="count(address) > 0">    
        <h3>address</h3>
        <ul>
            <xsl:for-each select="address">
                <li><xsl:value-of select="@addr"/> (<xsl:value-of select="@addrtype"/>)</li>                
            </xsl:for-each>
        </ul>
    </xsl:if>
    
	<xsl:apply-templates/>

</xsl:template>
<!-- ............................................................ -->



<!-- hostnames -->
<!-- ............................................................ -->
<xsl:template match="hostnames">
<xsl:if test="hostname/@name != ''"><h3>hostnames</h3><ul>	<xsl:apply-templates/></ul></xsl:if>
</xsl:template>
<!-- ............................................................ -->

<!-- hostname -->
<!-- ............................................................ -->
<xsl:template match="hostname">
<li><xsl:value-of select="@name"/> (<xsl:value-of select="@type"/>)</li>
</xsl:template>
<!-- ............................................................ -->

<!-- ports -->
<!-- ............................................................ -->
<xsl:template match="ports">
<h3>ports</h3>
<xsl:for-each select="extraports">
    <xsl:if test="@count > 0">
	    <p>The <xsl:value-of select="@count" /> ports scanned but not shown below are in state: <b><xsl:value-of select="@state" /></b></p>
    </xsl:if>
</xsl:for-each>

<xsl:if test="count(port) > 0">
    <table cellspacing="1">
    <tr class="head">
        <td colspan="2">Port</td>
        <td>State</td>
        <td>Service</td>
        <td>Product</td>
        <td>Version</td>
        <td>Extra info</td>
    </tr>
	<xsl:apply-templates/>
	</table>
</xsl:if>	
</xsl:template>
<!-- ............................................................ -->

<!-- port -->
<!-- ............................................................ -->
<xsl:template match="port">
	<xsl:choose>
		<xsl:when test="state/@state = 'open'">
            <tr class="open">
                <td><xsl:value-of select="@portid" /></td>
                <td><xsl:value-of select="@protocol" /></td>
                <td><xsl:value-of select="state/@state" /></td>
                <td><xsl:value-of select="service/@name" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@product" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@version" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@extrainfo" /><xsl:text>&#xA0;</xsl:text></td>
            </tr>
		</xsl:when>
		<xsl:when test="state/@state = 'filtered'">
            <tr class="filtered">
                <td><xsl:value-of select="@portid" /></td>
                <td><xsl:value-of select="@protocol" /></td>
                <td><xsl:value-of select="state/@state" /></td>
                <td><xsl:value-of select="service/@name" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@product" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@version" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@extrainfo" /><xsl:text>&#xA0;</xsl:text></td>
            </tr>
		</xsl:when>
		<xsl:when test="state/@state = 'closed'">
            <tr class="closed">
                <td><xsl:value-of select="@portid" /></td>
                <td><xsl:value-of select="@protocol" /></td>
                <td><xsl:value-of select="state/@state" /></td>
                <td><xsl:value-of select="service/@name" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@product" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@version" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@extrainfo" /><xsl:text>&#xA0;</xsl:text></td>
            </tr>
		</xsl:when>
		<xsl:otherwise>
            <tr>
                <td><xsl:value-of select="@portid" /></td>
                <td><xsl:value-of select="@protocol" /></td>
                <td><xsl:value-of select="state/@state" /></td>
                <td><xsl:value-of select="service/@name" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@product" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@version" /><xsl:text>&#xA0;</xsl:text></td>
                <td><xsl:value-of select="service/@extrainfo" /><xsl:text>&#xA0;</xsl:text></td>
            </tr>
		</xsl:otherwise>
	</xsl:choose>
</xsl:template>
<!-- ............................................................ -->

<!-- os -->
<!-- ............................................................ -->
<xsl:template match="os">
<xsl:if test="osmatch/@name != ''"><h3>remote operating system guess</h3></xsl:if>
<ul>
	<xsl:apply-templates/>
</ul>
</xsl:template>
<!-- ............................................................ -->

<!-- os portused -->
<!-- ............................................................ -->
<xsl:template match="portused">
<li>used port <xsl:value-of select="@portid" />/<xsl:value-of select="@proto" /> (<xsl:value-of select="@state" />)  </li>
</xsl:template>
<!-- ............................................................ -->

<!-- os match -->
<!-- ............................................................ -->
<xsl:template match="osmatch">
<li>os match: <b><xsl:value-of select="@name" /> </b></li>
<li>accuracy: <xsl:value-of select="@accuracy" />%</li>
<li>reference fingerprint line number: <xsl:value-of select="@line" /></li>
</xsl:template>
<!-- ............................................................ -->

<!-- uptime -->
<!-- ............................................................ -->
<xsl:template match="uptime">
<xsl:if test="@seconds != ''"><h3>system uptime</h3></xsl:if>
<ul>
<li>uptime: <xsl:value-of select="@seconds" /> sec</li>
<li>last reboot: <xsl:value-of select="@lastboot" /></li>
</ul>
</xsl:template>
<!-- ............................................................ -->

<!-- smurf -->
<!-- ............................................................ -->
<xsl:template match="smurf">
<xsl:if test="@responses != ''"><h3>smurf responses</h3></xsl:if>
<ul>
<li><xsl:value-of select="@responses" /> responses counted</li>
</ul>
</xsl:template>
<!-- ............................................................ -->

<!-- tcpsequence -->
<!-- ............................................................ -->
<xsl:template match="tcpsequence">
<xsl:if test="@values != ''">
    <h3>tcpsequence</h3>
    <ul>
        <li>index: <xsl:value-of select="@index" /></li>
        <li>class: <xsl:value-of select="@class" /></li>
        <li>difficulty: <xsl:value-of select="@difficulty" /></li>
        <li>values: <xsl:value-of select="@values" /></li>
    </ul>
</xsl:if>
</xsl:template>
<!-- ............................................................ -->

<!-- ipidsequence -->
<!-- ............................................................ -->
<xsl:template match="ipidsequence">
<xsl:if test="@values != ''">
    <h3>ipidsequence</h3>
    <ul>
        <li>class: <xsl:value-of select="@class" /></li>
        <li>values: <xsl:value-of select="@values" /></li>
    </ul>
</xsl:if>
</xsl:template>
<!-- ............................................................ -->

<!-- tcptssequence -->
<!-- ............................................................ -->
<xsl:template match="tcptssequence">
<xsl:if test="@values != ''">
    <h3>tcptssequence</h3>
    <ul>
        <li>class: <xsl:value-of select="@class" /></li>
        <li>values: <xsl:value-of select="@values" /></li>
    </ul>
</xsl:if>
</xsl:template>
<!-- ............................................................ -->

</xsl:stylesheet>
07070100243fed000081a40000000a0000000a0000000144fe8f2700001389000000880000000a00000000000000000000002500000005reloc/doc/nmap/docs/nmap_gpgkeys.txt  GPG detached signatures and MD5/SHA-1 hashes for each Nmap release are
available from http://www.insecure.org/nmap/dist/sigs/?C=M;O=D .  The
releases are signed by the Nmap project GPG key (KeyId 6B9355D0).
Some messages to Nmap mailing lists may be signed by Nmap author and
maintainer Fyodor.  Fyodor's KeyID is 33599B5F.  Those two keys and
their fingerprints are reproduced below.  The latest version of this
file is always available at
http://www.insecure.org/nmap/data/nmap_gpgkeys.txt .

To verify a file with GPG, obtain and import the keys with a command
such as "gpg --import nmap_gpgkeys.txt" and then verify the obtained
files as shown in this example:

 > gpg --verify nmap-3.81.tar.bz2.gpg.txt nmap-3.81.tar.bz2
 gpg: Signature made Sat 23 Apr 2005 11:34:32 PM PDT using DSA key ID 6B9355D0
 gpg: Good signature from "Nmap Project Signing Key (http://www.insecure.org/)"

Here are the GPG keys for the Nmap Project and Fyodor:

pub   1024D/6B9355D0 2005-04-24
      Key fingerprint = 436D 66AB 9A79 8425 FDA0  E3F8 01AF 9F03 6B93 55D0
uid   Nmap Project Signing Key (http://www.insecure.org/)
sub   2048g/A50A6A94 2005-04-24

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.1 (GNU/Linux)

mQGiBEJrBfgRBADogo5DEoGsm2C3OC3NoKBQ0J7Ixp/cymuMeGQmDhqP6Vfmxmso
BGln4nhDr3WMDW76Q2p6dHTZEbWx3NAna8q3wa3PrPTVRcmEgEgUd8y086I33NqW
BV5Fz4bvPWtSGc/4MxXwac+XqrGY+iTkaO3sd4/eEKa/KkJlXpIGAbGbZwCgq9HS
bHctYmUWmvz1YXJmFlQvnTsD/RRyTlnQ/AOpq2XPYy5AlUzHMWAef2Dt+wXYKSjp
zvqVWtl8QigrWSOP3ia39v+rDUF/CHb1U8mmx9XzRpy9KgS99Wi4IUnBCYM/e/IP
K5ReAoNoPMjLmLU4cxYzOxF1yzuSFvhXiKVy/QW6Qo9AP9YdlhlxxXrJA+HrAcXb
UE/SBACsoJRsIEyzcfm7Y/KA11enEhxo2nVZ/HpJCq8RHcaXxWFaCglKlydNaw1S
vlZkLggRXQrig6aHgVva3WC+gSYMk+SPtzYNrjWiDE+v+DoEFdNEuO8DXScTMGmB
pmUtZNWGoK9ewo9kE/ccGDl6lmrxfC9x2nYFHlCvV/PJrbTbfLQzTm1hcCBQcm9q
ZWN0IFNpZ25pbmcgS2V5IChodHRwOi8vd3d3Lmluc2VjdXJlLm9yZy8piF4EExEC
AB4FAkJrBfgCGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQAa+fA2uTVdBGbACf
e4qpukKV23yZjlbjEzJeCN8Gyh4AniXrbP7M+ul6zzWTFBgB6heYjKT8iEYEEBEC
AAYFAkJrGVAACgkQGvbsUDNZm1+kXgCfbBGI8UxrwiKRbtgYHOUYd6u5qdwAnRFZ
ryKFEzkuQGBQWfd6ys6ygjgtuQINBEJrBfoQCADUNWhc7n68jANoWAWl38itVGqI
qZEEvchV3m/uslVD0BSn/KRSY9/cZbMTX2hV8eemlGV2suJW4jWB0cQXjZQap4OL
WmMexeFA+q1YE803k0X4XgzRuJXkLaX3isCJGbgFRF6IfWmK38/gXz4YVBQXFQXy
4M2Y/o2GBsq8cQVgRAZNTQvN5oh2u8WN0wANk+iKySKqBG3Twgh4BbTaoajidSFR
hv3xFPw6dQFTd3fYyDlMcOQQcAdzzlS6hTyZuZLOXLdWckilnlP2/orQ5wUs6nXd
QeWuxME56z2vwNNeufoLWqNUlR1/IyRAfownDuvdjxYeIgsDd4DP+jInCpPzAAMG
CACZ8ewQdpWJ/4CgC7OT865DurNIQH0udm/CSB0mb3v0IxuuXMJml2yMi2NkJh8X
KMaluTznz2x8kpPXgmhu+qosAi+YUbdbP+/ilY6+WqLVQewSr7GmxJy6EWW5s2+S
3V7yneiDQXBUBMr4WwjfOxX7m/+Io7RSLQaWNq82C2fSukqpootVgLV7CaVJMHvZ
iA+3AL32N1d6O6h8bUqEyfOw3kIr19e0OhqWSpQrZs3tkUpwH7/vn/4NkAxjodkP
JChf1Y89pU98GBC9JxF+mc2mnDVUnUs31S8kQ/6PhZP8ldn47W2CakHSA3S/M99A
gltKiG6MR2z018fqD8FJC3tLiEkEGBECAAkFAkJrBfoCGwwACgkQAa+fA2uTVdBM
QgCfciVPJeohzn5mJ4WGE/6B1CyCOIYAn2ghTW1IKTP+tfOgxVg/p8HJOoiz
=18Dk
-----END PGP PUBLIC KEY BLOCK-----


pub   1024D/33599B5F 2005-04-24
      Key fingerprint = BB61 D057 C0D7 DCEF E730  996C 1AF6 EC50 3359 9B5F
uid   Fyodor <fyodor@insecure.org>
sub   2048g/D3C2241C 2005-04-24

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.1 (GNU/Linux)

mQGiBEJrBG4RBADfjVQenTh2v1NK2N0Wi83pGMm0u/IDDX8eT8lxSR+XdevdcK+F
bRhVh+tMhTo1T2OoZkBfYj+OVCWsBZlIxZtGycWaGAwn3MbUEiUJD0YVv4pm4KVk
HEZSOYEkzUFIw3IP03Cv6wBDrhk5lAu99+sK0iQGeHGw+gBhIuA3axSeBwCgn86p
r+C4P3w61musiflp1SosfSsEALwyE7o60S105UTijAn5tswqecZlumQAxQ+DIeC+
9F8mSujIZn8xb1wJtaZb2F0HU0vd67BaOIDXqO7KVe6Tx6JKf5zup2vaGRvUspNv
V8CLuSbT7WnnvTBM5dfBMTJw6xLjOsSTk65Q24xcTJ3f2efnYy9imAMl7EzhalBE
11pfBADVLuhe6rUpRrhaMJRXZJLdE9A2zcHWtM0X3DDe6QhaWU94JivtORKtleGv
atGu4or9jwIhXixeBsvu7RP3bWog5jiLgUWJrvJNeLcFQqIWTtIdh5iuInzezxbg
Fvst2YIdUrT+QdcYKKTnJNyUgXQBGKQ18ra8oMvakgUqVjrPnbQcRnlvZG9yIDxm
eW9kb3JAaW5zZWN1cmUub3JnPoheBBMRAgAeBQJCawRuAhsDBgsJCAcDAgMVAgMD
FgIBAh4BAheAAAoJEBr27FAzWZtfZwcAn0iGnn1p6wXuBTj7VQSdglTtJd46AJ9T
Gt51/ZUT2yiFG9vsc5CZn5WiRYicBBMBAgAGBQJCaxEpAAoJEM4dPqJTWH2VO4oE
AKso+R5gSO9jhtTiCIMoh9CqeboQCbBKzEwDhy7S7gChAHOz6HeOdcsyfnprwsiH
I+FjufxvdtmiIENSzyjqGxbMdO+Zoz5JMx1RtzrkjkE4GLVq0c6NzL/36MUtAjEU
tCTFXYZW6Lvu6SgnmlmelrAjqs10vZoOrbOlB/l9mn/EuQINBEJrBHIQCACUlrH2
qhVekDKeK9zQlBK2dxcIyPSwP6Tqv+rWvKEzHRUVNBcDSruuNVBNvJC3VQAj0oTA
XI+xoWGNx5CInX7qKFaGd9/MlsrEyjasRcY75lkr3QyTSk92q0luX1j+V1uumDWs
pacyki0Zt/9FhssjdkljFBPpDRPURxjJdJ6TCq6G0wPjelKsekRNvipIYcrcIs7I
EBtqsDCvQBRKgYzjUuziudOMoNFAn6eQHBu/B7RNtRzqTL1ugCjs0AEhLRKw+Ag6
bP3lTjmiR33wxajAuUPKe8abe7CfVPrGmihJSJaqULeldSHTugnf84/hTh9BQKYd
EZd3QlF72wRmCcnjAAMGB/4oXK4/BXExfnZ+QbmTIyQGJb/OcWa7Dc9WA6DnaE58
1BeZgYrKFQMdVpAhUMTxeqPIL4EVc6N+BkSk7JHf5+6DoK8KDJ1RJCCgYmdx7zdT
/GAZlUFDiYOs4sx75UZZGFcEEDmIHFC4s7B2HPuSfMoq5vBr0qi6pD1HCgyJV0aG
jhQdmfkp+fYEibPWrIGTsayQnYiCrVo3W7C7ZplekoAJkcN0rnfJeV1+kj694XSe
U6oYj9RaNoTV1xt1lx5Rwl00HwEYHWAsGmT6+pWmbXo5PT7N7OfcmtclICBsrcjC
hKcn6WdTitUR+uOXgL+86Th4W/FYdIXAyyC9KTXhMDmfiEkEGBECAAkFAkJrBHIC
GwwACgkQGvbsUDNZm19xAgCeNmaeak8iviUmHje1YAePwEFGleEAn26n8sNrVole
NtNX5k7XyTWBQUdG
=cBzb
-----END PGP PUBLIC KEY BLOCK-----
   07070100243fee000081a40000000a0000000a0000000144fe8f2700000ae0000000880000000a00000000000000000000001d00000005reloc/doc/nmap/docs/nmapfe.1  .\" This definition swiped from the gcc(1) man page
.de Sp
.if n .sp
.if t .sp 0.4
..
.TH NMAPFE 1
.SH NAME
nmapfe (xnmap) \- GTK+ graphical frontend to the Nmap Security Scanner
.SH SYNOPSIS
.B nmapfe 
[ any Glib options such as --display ]
.SH DESCRIPTION

.I Nmapfe
(also known as xnmap) is a convenient X Window front end for the Nmap
Security Scanner.  Most of the options correspond directly to Nmap
options, which are described in detail in the Nmap man page.  We
recommend you read that first.  There is also limited help available
via the NmapFE "Help" menu.
.SH AUTHOR
.Sp
NmapFE was originally written by Zach Smith
.I <key@aye.net>
.Sp
It is now maintained by Fyodor
.I <fyodor@insecure.org>
.Sp
Feel free to write me ( fyodor@insecure.org ) with 
questions or bug reports.
.SH DISTRIBUTION
The newest version of 
.I nmapfe
can be obtained from 
.I http://www.insecure.org/nmap/
.Sp
.I nmapfe
is (C) 1999, 2000 by Fyodor (fyodor@insecure.org)
.Sp
This program is free software; you can redistribute it
and/or modify it under the terms of the GNU General Public
License as published by the Free Software Foundation;
Version 2.  This guarantees your right to use, modify, and
redistribute Nmap under certain conditions.  If this license
is unacceptable to you, Insecure.Org may be willing to sell
alternative licenses (contact fyodor@insecure.org ).
.Sp
Source is provided to this software because we believe users
have a right to know exactly what a program is going to do
before they run it.  This also allows you to audit the
software for security holes (none have been found so far).
.Sp
Source code also allows you to port nmapfe to new platforms,
fix bugs, and add new features.  You are highly encouraged
to send your changes to Fyodor for possible incorporation
into the main Nmap distribution.  By sending these changes
to Fyodor or nmap-hackers, it is assumed that you are
offering Fyodor the unlimited, non-exclusive right to reuse,
modify, and relicense the code.  If you wish to specify
special license conditions of your contributions, please
state them up front.
.Sp
This program is distributed in the hope that it will be useful, but
.B WITHOUT ANY WARRANTY;
without even the implied warranty of
.B MERCHANTABILITY 
or 
.B FITNESS FOR A PARTICULAR PURPOSE.
See the GNU
General Public License for more details (it is in the COPYING file of
the
.I nmap 
distribution).  
.Sp
It should also be noted that Nmap has been known to crash
certain poorly written applications, TCP/IP stacks, and even
operating systems.
.B Nmap should never be run against mission critical systems 
unless you are prepared to suffer downtime.  We acknowledge
here that Nmap may crash your systems or networks and we
disclaim all liability for any damage or problems Nmap could
cause.
07070100243fef000081a40000000a0000000a0000000144fe8f2600000012000000880000000a00000000000000000000001c00000005reloc/doc/nmap/docs/xnmap.1   .so man1/nmapfe.1
  07070100243ff0000081a40000000a0000000a0000000144fe8f27000011f0000000880000000a00000000000000000000002000000005reloc/doc/nmap/nmap-4.11-1.spec   %define name nmap
%define version 4.11
%define release 1
%define prefix /usr

# To not build the frontend, add:
#   --define "buildfe 0"
# ...to the rpm build command-line
# To build a static rpm, add:
# --define "static 1"

%if "%{buildfe}" != "0"
%define buildfe 1
%endif

Summary: Network exploration tool and security scanner
Name: %{name}
Version: %{version}
Release: %{release}
Epoch: 2
License: http://www.insecure.org/nmap/man/man-legal.html
Group: Applications/System
Source0: http://www.insecure.org/nmap/dist/%{name}-%{version}.tgz
URL: http://www.insecure.org/nmap/
BuildRoot: %{_tmppath}/%{name}-root
# RPM can't be relocatable until I stop storing path info in the binary
# Prefix: %{prefix}

%description
Nmap is a utility for network exploration or security auditing. It
supports ping scanning (determine which hosts are up), many port
scanning techniques, version detection (determine service protocols
and application versions listening behind ports), and TCP/IP
fingerprinting (remote host OS or device identification). Nmap also
offers flexible target and port specification, decoy/stealth scanning,
sunRPC scanning, and more. Most Unix and Windows platforms are
supported in both GUI and commandline modes. Several popular handheld
devices are also supported, including the Sharp Zaurus and the iPAQ.

%if "%{buildfe}" == "1"
%package frontend
Summary: Gtk+ frontend for nmap
Group: Applications/System
Requires: nmap, gtk2
BuildPreReq: gtk2-devel
Version: %{version}
%description frontend
This package includes nmapfe, a Gtk+ frontend for nmap. The nmap package must
be installed before installing nmap-frontend.
%endif

%prep
%setup -q

%build
export CFLAGS="$RPM_OPT_FLAGS"
export CXXFLAGS="$RPM_OPT_FLAGS"
./configure --prefix=%{prefix} --mandir=%{prefix}/share/man --without-openssl
%if "%{static}" == "1"
make static
%else
make
%endif

%install
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT

make prefix=$RPM_BUILD_ROOT%{prefix} mandir=$RPM_BUILD_ROOT%{prefix}/share/man install

mkdir -p $RPM_BUILD_ROOT%{prefix}/share/applications

strip $RPM_BUILD_ROOT%{prefix}/bin/* || :
gzip $RPM_BUILD_ROOT%{prefix}/share/man/man1/* || :

%if "%{buildfe}" == "1"
%post frontend
%endif

%if "%{buildfe}" == "1"
%postun frontend
%endif

%clean
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT

%files 
%defattr(-,root,root)
%doc COPYING
%doc docs/README
%doc docs/nmap.usage.txt
%{prefix}/bin/nmap
%{prefix}/share/nmap
%{prefix}/share/man/man1/nmap.1.gz

%if "%{buildfe}" == "1"
%files frontend
%defattr(-,root,root)
%{prefix}/bin/nmapfe
%{prefix}/bin/xnmap
%{prefix}/share/applications/nmapfe.desktop
%{prefix}/share/man/man1/xnmap.1.gz
%{prefix}/share/man/man1/nmapfe.1.gz
%endif

%changelog

* Sat Sep 01 2004 Stephane Loeuillet (stephane.loeuillet(a)tiscali.fr)
- Place .desktop file under ${prefix}/share/applications rather than
  ${prefix}/share/gnome/apps/Utilities

* Mon Dec 16 2002 Matthieu Verbert (mve(a)zurich.ibm.com)
- Place man pages under ${prefix}/share/man rather than ${prefix}/man

* Fri Jun 01 2001 GOMEZ Henri (hgomez(a)slib.fr)
- Patch which checks that $RPM_BUILD_ROOT is not "/" before rm'ing it.

* Tue Mar 06 2001 Ben Reed <ben(a)opennms.org>
- changed spec to handle not building the frontend

* Thu Dec 30 1999 Fyodor (fyodor(a)insecure.org)
- Updated description
- Eliminated source1 (nmapfe.desktop) directive and simply packaged it with Nmap
- Fixed nmap distribution URL (source0)
- Added this .rpm to base Nmap distribution

* Mon Dec 13 1999 Tim Powers <timp(a)redhat.com>
- based on origional spec file from
	http://www.insecure.org/nmap/index.html#download
- general cleanups, removed lots of commenrts since it made the spec hard to
	read
- changed group to Applications/System
- quiet setup
- no need to create dirs in the install section, "make
	prefix=$RPM_BUILD_ROOT&{prefix} install" does this.
- using defined %{prefix}, %{version} etc. for easier/quicker maint.
- added docs
- gzip man pages
- strip after files have been installed into buildroot
- created separate package for the frontend so that Gtk+ isn't needed for the
	CLI nmap 
- not using -f in files section anymore, no need for it since there aren't that
	many files/dirs
- added desktop entry for gnome

* Sun Jan 10 1999 Fyodor (fyodor(a)insecure.org)
- Merged in spec file sent in by Ian Macdonald <ianmacd(a)xs4all.nl>

* Tue Dec 29 1998 Fyodor (fyodor(a)insecure.org)
- Made some changes, and merged in another .spec file sent in
  by Oren Tirosh <oren(a)hishome.net>

* Mon Dec 21 1998 Riku Meskanen (mesrik(a)cc.jyu.fi)
- initial build for RH 5.x
07070100243ff1000041ed0000000a0000000a0000000344fe8f2800000000000000880000000a00000000000000000000000a00000005reloc/man 07070100243ff2000041ed0000000a0000000a0000000244fe8f2800000000000000880000000a00000000000000000000000f00000005reloc/man/man1    07070100243ff3000081a40000000a0000000a0000000144fe8f260001f106000000880000000a00000000000000000000001600000005reloc/man/man1/nmap.1 .\" ** You probably do not want to edit this file directly **
.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
.\" Instead of manually editing it, you probably should edit the DocBook XML
.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
.TH "NMAP" "1" "06/23/2006" "" "Nmap Reference Guide"
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.SH "NAME"
nmap \- Network exploration tool and security / port scanner
.SH "SYNOPSIS"
.HP 5
\fBnmap\fR [\fIScan\ Type\fR...] [\fIOptions\fR] {\fItarget\ specification\fR}
.SH "DESCRIPTION"
.PP
Nmap (\(lqNetwork Mapper\(rq) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
.PP
The output from Nmap is a list of scanned targets, with supplemental information on each depending on the options used. Key among that information is the
\(lqinteresting ports table\(rq. That table lists the port number and protocol, service name, and state. The state is either
open,
filtered,
closed, or
unfiltered. Open means that an application on the target machine is listening for connections/packets on that port.
Filtered
means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is
open
or
closed.
Closed
ports have no application listening on them, though they could open up at any time. Ports are classified as
unfiltered
when they are responsive to Nmap's probes, but Nmap cannot determine whether they are open or closed. Nmap reports the state combinations
open|filtered
and
closed|filtered
when it cannot determine which of the two states describe a port. The port table may also include software version details when version detection has been requested. When an IP protocol scan is requested (\fB\-sO\fR), Nmap provides information on supported IP protocols rather than listening ports.
.PP
In addition to the interesting ports table, Nmap can provide further information on targets, including reverse DNS names, operating system guesses, device types, and MAC addresses.
.PP
A typical Nmap scan is shown in
Example\ 13.1, \(lqA representative Nmap scan\(rq. The only Nmap arguments used in this example are
\fB\-A\fR, to enable OS and version detection,
\fB\-T4\fR
for faster execution, and then the two target hostnames.
Example\ 13.1.\ A representative Nmap scan.sp
.nf
# nmap \-A \-T4 scanme.nmap.org playground

Starting nmap ( http://www.insecure.org/nmap/ )
Interesting ports on scanme.nmap.org (205.217.153.62):
(The 1663 ports scanned but not shown below are in state: filtered)
PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 3.9p1 (protocol 1.99)
53/tcp  open   domain
70/tcp  closed gopher
80/tcp  open   http    Apache httpd 2.0.52 ((Fedora))
113/tcp closed auth
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.7 \- 2.6.11, Linux 2.6.0 \- 2.6.11
Uptime 33.908 days (since Thu Jul 21 03:38:03 2005)

Interesting ports on playground.nmap.org (192.168.0.40):
(The 1659 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios\-ssn
389/tcp  open  ldap?
445/tcp  open  microsoft\-ds  Microsoft Windows XP microsoft\-ds
1002/tcp open  windows\-icfw?
1025/tcp open  msrpc         Microsoft Windows RPC
1720/tcp open  H.323/Q.931   CompTek AquaGateKeeper
5800/tcp open  vnc\-http      RealVNC 4.0 (Resolution 400x250; VNC TCP port: 5900)
5900/tcp open  vnc           VNC (protocol 3.8)
MAC Address: 00:A0:CC:63:85:4B (Lite\-on Communications)
Device type: general purpose
Running: Microsoft Windows NT/2K/XP
OS details: Microsoft Windows XP Pro RC1+ through final release
Service Info: OSs: Windows, Windows XP

Nmap finished: 2 IP addresses (2 hosts up) scanned in 88.392 seconds
.fi
.PP
The newest version of Nmap can be obtained from
\fI\%http://www.insecure.org/nmap/\fR. The newest version of the man page is available from
\fI\%http://www.insecure.org/nmap/man/\fR.
.SH "OPTIONS SUMMARY"
.PP
This options summary is printed when Nmap is run with no arguments, and the latest version is always available at
\fI\%http://www.insecure.org/nmap/data/nmap.usage.txt\fR. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual. Some obscure options aren't even included here.
.PP
.nf
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0\-255.1\-254
  \-iL <inputfilename>: Input from list of hosts/networks
  \-iR <num hosts>: Choose random targets
  \-\-exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  \-\-excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  \-sL: List Scan \- simply list targets to scan
  \-sP: Ping Scan \- go no further than determining if host is online
  \-P0: Treat all hosts as online \-\- skip host discovery
  \-PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
  \-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  \-n/\-R: Never do DNS resolution/Always resolve [default: sometimes]
  \-\-dns\-servers <serv1[,serv2],...>: Specify custom DNS servers
  \-\-system\-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
  \-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  \-sN/sF/sX: TCP Null, FIN, and Xmas scans
  \-\-scanflags <flags>: Customize TCP scan flags
  \-sI <zombie host[:probeport]>: Idlescan
  \-sO: IP protocol scan
  \-b <ftp relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  \-p <port ranges>: Only scan specified ports
    Ex: \-p22; \-p1\-65535; \-p U:53,111,137,T:21\-25,80,139,8080
  \-F: Fast \- Scan only the ports listed in the nmap\-services file)
  \-r: Scan ports consecutively \- don't randomize
SERVICE/VERSION DETECTION:
  \-sV: Probe open ports to determine service/version info
  \-\-version\-intensity <level>: Set from 0 (light) to 9 (try all probes)
  \-\-version\-light: Limit to most likely probes (intensity 2)
  \-\-version\-all: Try every single probe (intensity 9)
  \-\-version\-trace: Show detailed version scan activity (for debugging)
OS DETECTION:
  \-O: Enable OS detection
  \-\-osscan\-limit: Limit OS detection to promising targets
  \-\-osscan\-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in milliseconds, unless you append 's'
  (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  \-T[0\-5]: Set timing template (higher is faster)
  \-\-min\-hostgroup/max\-hostgroup <size>: Parallel host scan group sizes
  \-\-min\-parallelism/max\-parallelism <time>: Probe parallelization
  \-\-min\-rtt\-timeout/max\-rtt\-timeout/initial\-rtt\-timeout <time>: Specifies
      probe round trip time.
  \-\-max\-retries <tries>: Caps number of port scan probe retransmissions.
  \-\-host\-timeout <time>: Give up on target after this long
  \-\-scan\-delay/\-\-max\-scan\-delay <time>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
  \-f; \-\-mtu <val>: fragment packets (optionally w/given MTU)
  \-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  \-S <IP_Address>: Spoof source address
  \-e <iface>: Use specified interface
  \-g/\-\-source\-port <portnum>: Use given port number
  \-\-data\-length <num>: Append random data to sent packets
  \-\-ttl <val>: Set IP time\-to\-live field
  \-\-spoof\-mac <mac address/prefix/vendor name>: Spoof your MAC address
  \-\-badsum: Send packets with a bogus TCP/UDP checksum
OUTPUT:
  \-oN/\-oX/\-oS/\-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  \-oA <basename>: Output in the three major formats at once
  \-v: Increase verbosity level (use twice for more effect)
  \-d[level]: Set or increase debugging level (Up to 9 is meaningful)
  \-\-packet\-trace: Show all packets sent and received
  \-\-iflist: Print host interfaces and routes (for debugging)
  \-\-log\-errors: Log errors/warnings to the normal\-format output file
  \-\-append\-output: Append to rather than clobber specified output files
  \-\-resume <filename>: Resume an aborted scan
  \-\-stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  \-\-webxml: Reference stylesheet from Insecure.Org for more portable XML
  \-\-no\-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  \-6: Enable IPv6 scanning
  \-A: Enables OS detection and Version detection
  \-\-datadir <dirname>: Specify custom Nmap data file location
  \-\-send\-eth/\-\-send\-ip: Send using raw ethernet frames or IP packets
  \-\-privileged: Assume that the user is fully privileged
  \-V: Print version number
  \-h: Print this help summary page.
EXAMPLES:
  nmap \-v \-A scanme.nmap.org
  nmap \-v \-sP 192.168.0.0/16 10.0.0.0/8
  nmap \-v \-iR 10000 \-P0 \-p 80
.fi
.sp
.SH "TARGET SPECIFICATION"
.PP
Everything on the Nmap command\-line that isn't an option (or option argument) is treated as a target host specification. The simplest case is to specify a target IP address or hostname for scanning.
.PP
Sometimes you wish to scan a whole network of adjacent hosts. For this, Nmap supports CIDR\-style addressing. You can append

/\fInumbits\fR
to an IP address or hostname and Nmap will scan every IP address for which the first
\fInumbits\fR
are the same as for the reference IP or hostname given. For example, 192.168.10.0/24 would scan the 256 hosts between 192.168.10.0 (binary:
11000000 10101000 00001010 00000000) and 192.168.10.255 (binary:
11000000 10101000 00001010 11111111), inclusive. 192.168.10.40/24 would do exactly the same thing. Given that the host scanme.nmap.org is at the IP address 205.217.153.62, the specification scanme.nmap.org/16 would scan the 65,536 IP addresses between 205.217.0.0 and 205.217.255.255. The smallest allowed value is /1, which scans half the Internet. The largest value is 32, which scans just the named host or IP address because all address bits are fixed.
.PP
CIDR notation is short but not always flexible enough. For example, you might want to scan 192.168.0.0/16 but skip any IPs ending with .0 or .255 because they are commonly broadcast addresses. Nmap supports this through octet range addressing. Rather than specify a normal IP address, you can specify a comma separated list of numbers or ranges for each octet. For example, 192.168.0\-255.1\-254 will skip all addresses in the range that end in .0 and or .255. Ranges need not be limited to the final octects: the specifier 0\-255.0\-255.13.37 will perform an Internet\-wide scan for all IP addresses ending in 13.37. This sort of broad sampling can be useful for Internet surveys and research.
.PP
IPv6 addresses can only be specified by their fully qualified IPv6 address or hostname. CIDR and octet ranges aren't supported for IPv6 because they are rarely useful.
.PP
Nmap accepts multiple host specifications on the command line, and they don't need to be the same type. The command
\fBnmap scanme.nmap.org 192.168.0.0/16 10.0.0,1,3\-7.0\-255\fR
does what you would expect.
.PP
While targets are usually specified on the command lines, the following options are also available to control target selection:
.TP
\fB\-iL <inputfilename>\fR (Input from list)
Reads target specifications from
\fIinputfilename\fR. Passing a huge list of hosts is often awkward on the command line, yet it is a common desire. For example, your DHCP server might export a list of 10,000 current leases that you wish to scan. Or maybe you want to scan all IP addresses
\fIexcept\fR
for those to locate hosts using unauthorized static IP addresses. Simply generate the list of hosts to scan and pass that filename to Nmap as an argument to the
\fB\-iL\fR
option. Entries can be in any of the formats accepted by Nmap on the command line (IP address, hostname, CIDR, IPv6, or octet ranges). Each entry must be separated by one or more spaces, tabs, or newlines. You can specify a hyphen (\-) as the filename if you want Nmap to read hosts from standard input rather than an actual file.
.TP
\fB\-iR <num hosts>\fR (Choose random targets)
For Internet\-wide surveys and other research, you may want to choose targets at random. The
\fInum hosts\fR
argument tells Nmap how many IPs to generate. Undesirable IPs such as those in certain private, multicast, or unallocated address ranges are automatically skipped. The argument
0
can be specified for a never\-ending scan. Keep in mind that some network administrators bristle at unauthorized scans of their networks and may complain. Use this option at your own risk! If you find yourself really bored one rainy afternoon, try the command
\fBnmap \-sS \-PS80 \-iR 0 \-p 80\fR
to locate random web servers for browsing.
.TP
\fB\-\-exclude <host1[,host2][,host3],...>\fR (Exclude hosts/networks)
Specifies a comma\-separated list of targets to be excluded from the scan even if they are part of the overall network range you specify. The list you pass in uses normal Nmap syntax, so it can include hostnames, CIDR netblocks, octet ranges, etc. This can be useful when the network you wish to scan includes untouchable mission\-critical servers, systems that are known to react adversely to port scans, or subnetworks administered by other people.
.TP
\fB\-\-excludefile <exclude_file>\fR (Exclude list from file)
This offers the same functionality as the
\fB\-\-exclude\fR
option, except that the excluded targets are provided in a newline, space, or tab delimited
\fIexclude_file\fR
rather than on the command line.
.SH "HOST DISCOVERY"
.PP
One of the very first steps in any network reconnaissance mission is to reduce a (sometimes huge) set of IP ranges into a list of active or interesting hosts. Scanning every port of every single IP address is slow and usually unnecessary. Of course what makes a host interesting depends greatly on the scan purposes. Network administrators may only be interested in hosts running a certain service, while security auditors may care about every single device with an IP address. An administrator may be comfortable using just an ICMP ping to locate hosts on his internal network, while an external penetration tester may use a diverse set of dozens of probes in an attempt to evade firewall restrictions.
.PP
Because host discovery needs are so diverse, Nmap offers a wide variety of options for customizing the techniques used. Host discovery is sometimes called ping scan, but it goes well beyond the simple ICMP echo request packets associated with the ubiquitous
ping
tool. Users can skip the ping step entirely with a list scan (\fB\-sL\fR) or by disabling ping (\fB\-P0\fR), or engage the network with arbitrary combinations of multi\-port TCP SYN/ACK, UDP, and ICMP probes. The goal of these probes is to solicit responses which demonstrate that an IP address is actually active (is being used by a host or network device). On many networks, only a small percentage of IP addresses are active at any given time. This is particularly common with RFC1918\-blessed private address space such as 10.0.0.0/8. That network has 16 million IPs, but I have seen it used by companies with less than a thousand machines. Host discovery can find those machines in a sparsely allocated sea of IP addresses.
.PP
If no host discovery options are given, Nmap sends a TCP ACK packet destined for port 80 and an ICMP Echo Request query to each target machine. An exception to this is that an ARP scan is used for any targets which are on a local ethernet network. For unprivileged UNIX shell users, a SYN packet is sent instead of the ack using the
\fBconnect()\fR
system call. These defaults are equivalent to the
\fB\-PA \-PE\fR
options. This host discovery is often sufficient when scanning local networks, but a more comprehensive set of discovery probes is recommended for security auditing.
.PP
The
\fB\-P*\fR
options (which select ping types) can be combined. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes. Also note that ARP discovery (\fB\-PR\fR) is done by default against targets on a local ethernet network even if you specify other
\fB\-P*\fR
options, because it is almost always faster and more effective.
.PP
By default, Nmap does host discovery and then performs a port scan against each host it determines is online. This is true even if you specify non\-default host discovery types such as UDP probes (\fB\-PU\fR). Read about the
\fB\-sP\fR
option to learn how to perform
\fIonly\fR
host discovery, or use
\fB\-P0\fR
to skip host discovery and port scan all target hosts. The following options control host discovery:
.TP
\fB\-sL\fR (List Scan)
The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse\-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example,
fw.chi.playboy.com
is the firewall for the Chicago office of Playboy Enterprises. Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company's network.
.sp
Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the
\fB\-P0\fR
option.
.TP
\fB\-sP\fR (Ping Scan)
This option tells Nmap to
\fIonly\fR
perform a ping scan (host discovery), then print out the available hosts that responded to the scan. No further testing (such as port scanning or OS detection) is performed. This is one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.
.sp
Systems administrators often find this option valuable as well. It can easily be used to count available machines on a network or monitor server availability. This is often called a ping sweep, and is more reliable than pinging the broadcast address because many hosts do not reply to broadcast queries.
.sp
The
\fB\-sP\fR
option sends an ICMP echo request and a TCP packet to port 80 by default. When executed by an unprivileged user, a SYN packet is sent (using a
\fBconnect()\fR
call) to port 80 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests (\fB\-PR\fR) are used unless
\fB\-\-send\-ip\fR
was specified. The
\fB\-sP\fR
option can be combined with any of the discovery probe types (the
\fB\-P*\fR
options, excluding
\fB\-P0\fR) for greater flexibility. If any of those probe type and port number options are used, the default probes (ACK and echo request) are overridden. When strict firewalls are in place between the source host running Nmap and the target network, using those advanced techniques is recommended. Otherwise hosts could be missed when the firewall drops probes or their responses.
.TP
\fB\-P0\fR (No ping)
This option skips the Nmap discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning. By default, Nmap only performs heavy probing such as port scans, version detection, or OS detection against hosts that are found to be up. Disabling host discovery with
\fB\-P0\fR
causes Nmap to attempt the requested scanning functions against
\fIevery\fR
target IP address specified. So if a class B sized target address space (/16) is specified on the command line, all 65,536 IP addresses are scanned. That second option character in
\fB\-P0\fR
is a zero and not the letter O. Proper host discovery is skipped as with the list scan, but instead of stopping and printing the target list, Nmap continues to perform requested functions as if each target IP is active.
.TP
\fB\-PS [portlist]\fR (TCP SYN Ping)
This option sends an empty TCP packet with the SYN flag set. The default destination port is 80 (configurable at compile time by changing DEFAULT_TCP_PROBE_PORT in
\fInmap.h\fR), but an alternate port can be specified as a parameter. A comma separated list of ports can even be specified (e.g.
\fB\-PS22,23,25,80,113,1050,35000\fR), in which case probes will be attempted against each port in parallel.
.sp
The SYN flag suggests to the remote system that you are attempting to establish a connection. Normally the destination port will be closed, and a RST (reset) packet sent back. If the port happens to be open, the target will take the second step of a TCP 3\-way\-handshake by responding with a SYN/ACK TCP packet. The machine running Nmap then tears down the nascent connection by responding with a RST rather than sending an ACK packet which would complete the 3\-way\-handshake and establish a full connection. The RST packet is sent by the kernel of the machine running Nmap in response to the unexpected SYN/ACK, not by Nmap itself.
.sp
Nmap does not care whether the port is open or closed. Either the RST or SYN/ACK response discussed previously tell Nmap that the host is available and responsive.
.sp
On UNIX boxes, only the privileged user
root
is generally able to send and receive raw TCP packets. For unprivileged users, a workaround is automatically employed whereby the connect() system call is initiated against each target port. This has the effect of sending a SYN packet to the target host, in an attempt to establish a connection. If connect() returns with a quick success or an ECONNREFUSED failure, the underlying TCP stack must have received a SYN/ACK or RST and the host is marked available. If the connection attempt is left hanging until a timeout is reached, the host is marked as down. This workaround is also used for IPv6 connections, as raw IPv6 packet building support is not yet available in Nmap.
.TP
\fB\-PA [portlist]\fR (TCP ACK Ping)
The TCP ACK ping is quite similar to the just\-discussed SYN ping. The difference, as you could likely guess, is that the TCP ACK flag is set instead of the SYN flag. Such an ACK packet purports to be acknowledging data over an established TCP connection, but no such connection exists. So remote hosts should always respond with a RST packet, disclosing their existence in the process.
.sp
The
\fB\-PA\fR
option uses the same default port as the SYN probe (80) and can also take a list of destination ports in the same format. If an unprivileged user tries this, or an IPv6 target is specified, the connect() workaround discussed previously is used. This workaround is imperfect because connect() is actually sending a SYN packet rather than an ACK.
.sp
The reason for offering both SYN and ACK ping probes is to maximize the chances of bypassing firewalls. Many administrators configure routers and other simple firewalls to block incoming SYN packets except for those destined for public services like the company web site or mail server. This prevents other incoming connections to the organization, while allowing users to make unobstructed outgoing connections to the Internet. This non\-stateful approach takes up few resources on the firewall/router and is widely supported by hardware and software filters. The Linux Netfilter/iptables firewall software offers the
\fB\-\-syn\fR
convenience option to implement this stateless approach. When stateless firewall rules such as this are in place, SYN ping probes (\fB\-PS\fR) are likely to be blocked when sent to closed target ports. In such cases, the ACK probe shines as it cuts right through these rules.
.sp
Another common type of firewall uses stateful rules that drop unexpected packets. This feature was initially found mostly on high\-end firewalls, though it has become much more common over the years. The Linux Netfilter/iptables system supports this through the
\fB\-\-state\fR
option, which categorizes packets based on connection state. A SYN probe is more likely to work against such a system, as unexpected ACK packets are generally recognized as bogus and dropped. A solution to this quandary is to send both SYN and ACK probes by specifying
\fB\-PS\fR
and
\fB\-PA\fR.
.TP
\fB\-PU [portlist]\fR (UDP Ping)
Another host discovery option is the UDP ping, which sends an empty (unless
\fB\-\-data\-length\fR
is specified) UDP packet to the given ports. The portlist takes the same format as with the previously discussed
\fB\-PS\fR
and
\fB\-PA\fR
options. If no ports are specified, the default is 31338. This default can be configured at compile\-time by changing DEFAULT_UDP_PROBE_PORT in
\fInmap.h\fR. A highly uncommon port is used by default because sending to open ports is often undesirable for this particular scan type.
.sp
Upon hitting a closed port on the target machine, the UDP probe should elicit an ICMP port unreachable packet in return. This signifies to Nmap that the machine is up and available. Many other types of ICMP errors, such as host/network unreachables or TTL exceeded are indicative of a down or unreachable host. A lack of response is also interpreted this way. If an open port is reached, most services simply ignore the empty packet and fail to return any response. This is why the default probe port is 31338, which is highly unlikely to be in use. A few services, such as chargen, will respond to an empty UDP packet, and thus disclose to Nmap that the machine is available.
.sp
The primary advantage of this scan type is that it bypasses firewalls and filters that only screen TCP. For example, I once owned a Linksys BEFW11S4 wireless broadband router. The external interface of this device filtered all TCP ports by default, but UDP probes would still elicit port unreachable messages and thus give away the device.
.TP
\fB\-PE\fR; \fB\-PP\fR; \fB\-PM\fR (ICMP Ping Types)
In addition to the unusual TCP and UDP host discovery types discussed previously, Nmap can send the standard packets sent by the ubiquitous
ping
program. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (Echo Reply) in return from available hosts. Unfortunately for network explorers, many hosts and firewalls now block these packets, rather than responding as required by
[1]\&\fIRFC 1122\fR. For this reason, ICMP\-only scans are rarely reliable enough against unknown targets over the Internet. But for system administrators monitoring an internal network, they can be a practical and efficient approach. Use the
\fB\-PE\fR
option to enable this echo request behavior.
.sp
While echo request is the standard ICMP ping query, Nmap does not stop there. The ICMP standard ([2]\&\fIRFC 792\fR) also specifies timestamp request, information request, and address mask request packets as codes 13, 15, and 17, respectively. While the ostensible purpose for these queries is to learn information such as address masks and current times, they can easily be used for host discovery. A system that replies is up and available. Nmap does not currently implement information request packets, as they are not widely supported. RFC 1122 insists that
\(lqa host SHOULD NOT implement these messages\(rq. Timestamp and address mask queries can be sent with the
\fB\-PP\fR
and
\fB\-PM\fR
options, respectively. A timestamp reply (ICMP code 14) or address mask reply (code 18) discloses that the host is available. These two queries can be valuable when admins specifically block echo request packets while forgetting that other ICMP queries can be used for the same purpose.
.TP
\fB\-PR\fR (ARP Ping)
One of the most common Nmap usage scenarios is to scan an ethernet LAN. On most LANs, especially those using RFC1918\-blessed private address ranges, the vast majority of IP addresses are unused at any given time. When Nmap tries to send a raw IP packet such as an ICMP echo request, the operating system must determine the destination hardware (ARP) address corresponding to the target IP so that it can properly address the ethernet frame. This is often slow and problematic, since operating systems weren't written with the expectation that they would need to do millions of ARP requests against unavailable hosts in a short time period.
.sp
ARP scan puts Nmap and its optimized algorithms in charge of ARP requests. And if it gets a response back, Nmap doesn't even need to worry about the IP\-based ping packets since it already knows the host is up. This makes ARP scan much faster and more reliable than IP\-based scans. So it is done by default when scanning ethernet hosts that Nmap detects are on a local ethernet network. Even if different ping types (such as
\fB\-PE\fR
or
\fB\-PS\fR) are specified, Nmap uses ARP instead for any of the targets which are on the same LAN. If you absolutely don't want to do an ARP scan, specify
\fB\-\-send\-ip\fR.
.TP
\fB\-n\fR (No DNS resolution)
Tells Nmap to
\fInever\fR
do reverse DNS resolution on the active IP addresses it finds. Since DNS is often slow, this speeds things up.
.TP
\fB\-R\fR (DNS resolution for all targets)
Tells Nmap to
\fIalways\fR
do reverse DNS resolution on the target IP addresses. Normally this is only performed when a machine is found to be alive.
.TP
\fB\-\-system\-dns\fR (Use system DNS resolver)
By default, Nmap resolves IP addresses by sending queries directly to the name servers configured on your host and then listening for responses. Many requests (often dozens) are performed in parallel for performance. Specify this option if you wish to use your system resolver instead (one IP at a time via the getnameinfo() call). This is slower and rarely useful unless there is a bug in the Nmap DNS code \-\- please contact us if that is the case. The system resolver is always used for IPv6 scans.
.TP
\fB\-\-dns\-servers <server1[,server2],...> \fR (Servers to use for reverse DNS queries)
By default Nmap will try to determine your DNS servers (for rDNS resolution) from your resolv.conf file (UNIX) or the registry (Win32). Alternatively, you may use this option to specify alternate servers. This option is not honored if you are using
\fB\-\-system\-dns\fR
or an IPv6 scan. Using multiple DNS servers is often faster and more stealthy than querying just one. The best performance is often obtained by specifying all of the authoritative servers for the target IP space.
.SH "PORT SCANNING BASICS"
.PP
While Nmap has grown in functionality over the years, it began as an efficient port scanner, and that remains its core function. The simple command
\fBnmap \fR\fB\fItarget\fR\fR
scans more than 1660 TCP ports on the host
\fItarget\fR. While many port scanners have traditionally lumped all ports into the open or closed states, Nmap is much more granular. It divides ports into six states:
open,
closed,
filtered,
unfiltered,
open|filtered, or
closed|filtered.
.PP
These states are not intrinsic properties of the port itself, but describe how Nmap sees them. For example, an Nmap scan from the same network as the target may show port 135/tcp as open, while a scan at the same time with the same options from across the Internet might show that port as
filtered.
.PP
\fBThe six port states recognized by Nmap\fR
.TP
open
An application is actively accepting TCP connections or UDP packets on this port. Finding these is often the primary goal of port scanning. Security\-minded people know that each open port is an avenue for attack. Attackers and pen\-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non\-security scans because they show services available for use on the network.
.TP
closed
A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.
.TP
filtered
Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host\-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.
.TP
unfiltered
The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open.
.TP
open|filtered
Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP Protocol, FIN, Null, and Xmas scans classify ports this way.
.TP
closed|filtered
This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IPID Idle scan.
.SH "PORT SCANNING TECHNIQUES"
.PP
As a novice performing automotive repair, I can struggle for hours trying to fit my rudimentary tools (hammer, duct tape, wrench, etc.) to the task at hand. When I fail miserably and tow my jalopy to a real mechanic, he invariably fishes around in a huge tool chest until pulling out the perfect gizmo which makes the job seem effortless. The art of port scanning is similar. Experts understand the dozens of scan techniques and choose the appropriate one (or combination) for a given task. Inexperienced users and script kiddies, on the other hand, try to solve every problem with the default SYN scan. Since Nmap is free, the only barrier to port scanning mastery is knowledge. That certainly beats the automotive world, where it may take great skill to determine that you need a strut spring compressor, then you still have to pay thousands of dollars for it.
.PP
Most of the scan types are only available to privileged users. This is because they send and receive raw packets, which requires root access on UNIX systems. Using an administrator account on Windows is recommended, though Nmap sometimes works for unprivileged users on that platform when WinPcap has already been loaded into the OS. Requiring root privileges was a serious limitation when Nmap was released in 1997, as many users only had access to shared shell accounts. Now, the world is different. Computers are cheaper, far more people have always\-on direct Internet access, and desktop UNIX systems (including Linux and MAC OS X) are prevalent. A Windows version of Nmap is now available, allowing it to run on even more desktops. For all these reasons, users have less need to run Nmap from limited shared shell accounts. This is fortunate, as the privileged options make Nmap far more powerful and flexible.
.PP
While Nmap attempts to produce accurate results, keep in mind that all of its insights are based on packets returned by the target machines (or firewalls in front of them). Such hosts may be untrustworthy and send responses intended to confuse or mislead Nmap. Much more common are non\-RFC\-compliant hosts that do not respond as they should to Nmap probes. FIN, Null, and Xmas scans are particularly susceptible to this problem. Such issues are specific to certain scan types and so are discussed in the individual scan type entries.
.PP
This section documents the dozen or so port scan techniques supported by Nmap. Only one method may be used at a time, except that UDP scan (\fB\-sU\fR) may be combined with any one of the TCP scan types. As a memory aid, port scan type options are of the form
\fB\-s\fR\fB\fIC\fR\fR, where
\fIC\fR
is a prominent character in the scan name, usually the first. The one exception to this is the deprecated FTP bounce scan (\fB\-b\fR). By default, Nmap performs a SYN Scan, though it substitutes a connect scan if the user does not have proper privileges to send raw packets (requires root access on UNIX) or if IPv6 targets were specified. Of the scans listed in this section, unprivileged users can only execute connect and ftp bounce scans.
.TP
\fB\-sS\fR (TCP SYN scan)
SYN scan is the default and most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by intrusive firewalls. SYN scan is relatively unobtrusive and stealthy, since it never completes TCP connections. It also works against any compliant TCP stack rather than depending on idiosyncrasies of specific platforms as Nmap's Fin/Null/Xmas, Maimon and Idle scans do. It also allows clear, reliable differentiation between the
open,
closed, and
filtered
states.
.sp
This technique is often referred to as half\-open scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and then wait for a response. A SYN/ACK indicates the port is listening (open), while a RST (reset) is indicative of a non\-listener. If no response is received after several retransmissions, the port is marked as filtered. The port is also marked filtered if an ICMP unreachable error (type 3, code 1,2, 3, 9, 10, or 13) is received.
.TP
\fB\-sT\fR (TCP connect scan)
TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges or is scanning IPv6 networks. Instead of writing raw packets as most other scan types do, Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the
connect()
system call. This is the same high\-level system call that web browsers, P2P clients, and most other network\-enabled applications use to establish a connection. It is part of a programming interface known as the Berkeley Sockets API. Rather than read raw packet responses off the wire, Nmap uses this API to obtain status information on each connection attempt.
.sp
When SYN scan is available, it is usually a better choice. Nmap has less control over the high level
connect()
call than with raw packets, making it less efficient. The system call completes connections to open target ports rather than performing the half\-open reset that SYN scan does. Not only does this take longer and require more packets to obtain the same information, but target machines are more likely to log the connection. A decent IDS will catch either, but most machines have no such alarm system. Many services on your average UNIX system will add a note to syslog, and sometimes a cryptic error message, when Nmap connects and then closes the connection without sending data. Truly pathetic services crash when this happens, though that is uncommon. An administrator who sees a bunch of connection attempts in her logs from a single system should know that she has been connect scanned.
.TP
\fB\-sU\fR (UDP scans)
While most popular services on the Internet run over the TCP protocol,
[3]\&\fIUDP\fR
services are widely deployed. DNS, SNMP, and DHCP (registered ports 53, 161/162, and 67/68) are three of the most common. Because UDP scanning is generally slower and more difficult than TCP, some security auditors ignore these ports. This is a mistake, as exploitable UDP services are quite common and attackers certainly don't ignore the whole protocol. Fortunately, Nmap can help inventory UDP ports.
.sp
UDP scan is activated with the
\fB\-sU\fR
option. It can be combined with a TCP scan type such as SYN scan (\fB\-sS\fR) to check both protocols during the same run.
.sp
UDP scan works by sending an empty (no data) UDP header to every targeted port. If an ICMP port unreachable error (type 3, code 3) is returned, the port is
closed. Other ICMP unreachable errors (type 3, codes 1, 2, 9, 10, or 13) mark the port as
filtered. Occasionally, a service will respond with a UDP packet, proving that it is
open. If no response is received after retransmissions, the port is classified as
open|filtered. This means that the port could be open, or perhaps packet filters are blocking the communication. Versions scan (\fB\-sV\fR) can be used to help differentiate the truly open ports from the filtered ones.
.sp
A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost. Closed ports are often an even bigger problem. They usually send back an ICMP port unreachable error. But unlike the RST packets sent by closed TCP ports in response to a SYN or connect scan, many hosts rate limit ICMP port unreachable messages by default. Linux and Solaris are particularly strict about this. For example, the Linux 2.4.20 kernel limits destination unreachable messages to one per second (in
\fInet/ipv4/icmp.c\fR).
.sp
Nmap detects rate limiting and slows down accordingly to avoid flooding the network with useless packets that the target machine will drop. Unfortunately, a Linux\-style limit of one packet per second makes a 65,536\-port scan take more than 18 hours. Ideas for speeding your UDP scans up include scanning more hosts in parallel, doing a quick scan of just the popular ports first, scanning from behind the firewall, and using
\fB\-\-host\-timeout\fR
to skip slow hosts.
.TP
\fB\-sN\fR; \fB\-sF\fR; \fB\-sX\fR (TCP Null, FIN, and Xmas scans)
These three scan types (even more are possible with the
\fB\-\-scanflags\fR
option described in the next section) exploit a subtle loophole in the
[4]\&\fITCP RFC\fR
to differentiate between
open
and
closed
ports. Page 65 says that
\(lqif the [destination] port state is CLOSED .... an incoming segment not containing a RST causes a RST to be sent in response.\(rq
Then the next page discusses packets sent to open ports without the SYN, RST, or ACK bits set, stating that:
\(lqyou are unlikely to get here, but if you do, drop the segment, and return.\(rq
.sp
When scanning systems compliant with this RFC text, any packet not containing SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response at all if the port is open. As long as none of those three bits are included, any combination of the other three (FIN, PSH, and URG) are OK. Nmap exploits this with three scan types:
.RS
.TP
Null scan (\fB\-sN\fR)
Does not set any bits (tcp flag header is 0)
.TP
FIN scan (\fB\-sF\fR)
Sets just the TCP FIN bit.
.TP
Xmas scan (\fB\-sX\fR)
Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.
.RE
.IP
These three scan types are exactly the same in behavior except for the TCP flags set in probe packets. If a RST packet is received, the port is considered
closed, while no response means it is
open|filtered. The port is marked
filtered
if an ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13) is received.
.sp
The key advantage to these scan types is that they can sneak through certain non\-stateful firewalls and packet filtering routers. Another advantage is that these scan types are a little more stealthy than even a SYN scan. Don't count on this though \-\- most modern IDS products can be configured to detect them. The big downside is that not all systems follow RFC 793 to the letter. A number of systems send RST responses to the probes regardless of whether the port is open or not. This causes all of the ports to be labeled
closed. Major operating systems that do this are Microsoft Windows, many Cisco devices, BSDI, and IBM OS/400. This scan does work against most UNIX\-based systems though. Another downside of these scans is that they can't distinguish
open
ports from certain
filtered
ones, leaving you with the response
open|filtered.
.TP
\fB\-sA\fR (TCP ACK scan)
This scan is different than the others discussed so far in that it never determines
open
(or even
open|filtered) ports. It is used to map out firewall rulesets, determining whether they are stateful or not and which ports are filtered.
.sp
The ACK scan probe packet has only the ACK flag set (unless you use
\fB\-\-scanflags\fR). When scanning unfiltered systems,
open
and
closed
ports will both return a RST packet. Nmap then labels them as
unfiltered, meaning that they are reachable by the ACK packet, but whether they are
open
or
closed
is undetermined. Ports that don't respond, or send certain ICMP error messages back (type 3, code 1, 2, 3, 9, 10, or 13), are labeled
filtered.
.TP
\fB\-sW\fR (TCP Window scan)
Window scan is exactly the same as ACK scan except that it exploits an implementation detail of certain systems to differentiate open ports from closed ones, rather than always printing
unfiltered
when a RST is returned. It does this by examining the TCP Window field of the RST packets returned. On some systems, open ports use a positive window size (even for RST packets) while closed ones have a zero window. So instead of always listing a port as
unfiltered
when it receives a RST back, Window scan lists the port as
open
or
closed
if the TCP Window value in that reset is positive or zero, respectively.
.sp
This scan relies on an implementation detail of a minority of systems out on the Internet, so you can't always trust it. Systems that don't support it will usually return all ports
closed. Of course, it is possible that the machine really has no open ports. If most scanned ports are
closed
but a few common port numbers (such as 22, 25, 53) are
filtered, the system is most likely susceptible. Occasionally, systems will even show the exact opposite behavior. If your scan shows 1000 open ports and 3 closed or filtered ports, then those three may very well be the truly open ones.
.TP
\fB\-sM\fR (TCP Maimon scan)
The Maimon scan is named after its discoverer, Uriel Maimon. He described the technique in Phrack Magazine issue #49 (November 1996). Nmap, which included this technique, was released two issues later. This technique is exactly the same as Null, FIN, and Xmas scans, except that the probe is FIN/ACK. According to RFC 793 (TCP), a RST packet should be generated in response to such a probe whether the port is open or closed. However, Uriel noticed that many BSD\-derived systems simply drop the packet if the port is open.
.TP
\fB\-\-scanflags\fR (Custom TCP scan)
Truly advanced Nmap users need not limit themselves to the canned scan types offered. The
\fB\-\-scanflags\fR
option allows you to design your own scan by specifying arbitrary TCP flags. Let your creative juices flow, while evading intrusion detection systems whose vendors simply paged through the Nmap man page adding specific rules!
.sp
The
\fB\-\-scanflags\fR
argument can be a numerical flag value such as 9 (PSH and FIN), but using symbolic names is easier. Just mash together any combination of
URG,
ACK,
PSH,
RST,
SYN, and
FIN. For example,
\fB\-\-scanflags URGACKPSHRSTSYNFIN\fR
sets everything, though it's not very useful for scanning. The order these are specified in is irrelevant.
.sp
In addition to specifying the desired flags, you can specify a TCP scan type (such as
\fB\-sA\fR
or
\fB\-sF\fR). That base type tells Nmap how to interpret responses. For example, a SYN scan considers no\-response to indicate a
filtered
port, while a FIN scan treats the same as
open|filtered. Nmap will behave the same way it does for the base scan type, except that it will use the TCP flags you specify instead. If you don't specify a base type, SYN scan is used.
.TP
\fB\-sI <zombie host[:probeport]>\fR (Idlescan)
This advanced scan method allows for a truly blind TCP port scan of the target (meaning no packets are sent to the target from your real IP address). Instead, a unique side\-channel attack exploits predictable IP fragmentation ID sequence generation on the zombie host to glean information about the open ports on the target. IDS systems will display the scan as coming from the zombie machine you specify (which must be up and meet certain criteria). This fascinating scan type is too complex to fully describe in this reference guide, so I wrote and posted an informal paper with full details at
\fI\%http://www.insecure.org/nmap/idlescan.html\fR.
.sp
Besides being extraordinarily stealthy (due to its blind nature), this scan type permits mapping out IP\-based trust relationships between machines. The port listing shows open ports
\fIfrom the perspective of the zombie host.\fR
So you can try scanning a target using various zombies that you think might be trusted (via router/packet filter rules).
.sp
You can add a colon followed by a port number to the zombie host if you wish to probe a particular port on the zombie for IPID changes. Otherwise Nmap will use the port it uses by default for tcp pings (80).
.TP
\fB\-sO\fR (IP protocol scan)
IP Protocol scan allows you to determine which IP protocols (TCP, ICMP, IGMP, etc.) are supported by target machines. This isn't technically a port scan, since it cycles through IP protocol numbers rather than TCP or UDP port numbers. Yet it still uses the
\fB\-p\fR
option to select scanned protocol numbers, reports its results within the normal port table format, and even uses the same underlying scan engine as the true port scanning methods. So it is close enough to a port scan that it belongs here.
.sp
Besides being useful in its own right, protocol scan demonstrates the power of open source software. While the fundamental idea is pretty simple, I had not thought to add it nor received any requests for such functionality. Then in the summer of 2000, Gerhard Rieger conceived the idea, wrote an excellent patch implementing it, and sent it to the nmap\-hackers mailing list. I incorporated that patch into the Nmap tree and released a new version the next day. Few pieces of commercial software have users enthusiastic enough to design and contribute their own improvements!
.sp
Protocol scan works in a similar fashion to UDP scan. Instead of iterating through the port number field of a UDP packet, it sends IP packet headers and iterates through the 8\-bit IP protocol field. The headers are usually empty, containing no data and not even the proper header for the claimed protocol. The three exceptions are TCP, UDP, and ICMP. A proper protocol header for those is included since some systems won't send them otherwise and because Nmap already has functions to create them. Instead of watching for ICMP port unreachable messages, protocol scan is on the lookout for ICMP
\fIprotocol\fR
unreachable messages. If Nmap receives any response in any protocol from the target host, Nmap marks that protocol as
open. An ICMP protocol unreachable error (type 3, code 2) causes the protocol to be marked as
closed
Other ICMP unreachable errors (type 3, code 1, 3, 9, 10, or 13) cause the protocol to be marked
filtered
(though they prove that ICMP is
open
at the same time). If no response is received after retransmissions, the protocol is marked
open|filtered
.TP
\fB\-b <ftp relay host>\fR (FTP bounce scan)
An interesting feature of the FTP protocol ([5]\&\fIRFC 959\fR) is support for so\-called proxy ftp connections. This allows a user to connect to one FTP server, then ask that files be sent to a third\-party server. Such a feature is ripe for abuse on many levels, so most servers have ceased supporting it. One of the abuses this feature allows is causing the FTP server to port scan other hosts. Simply ask the FTP server to send a file to each interesting port of a target host in turn. The error message will describe whether the port is open or not. This is a good way to bypass firewalls because organizational FTP servers are often placed where they have more access to other internal hosts than any old Internet host would. Nmap supports ftp bounce scan with the
\fB\-b\fR
option. It takes an argument of the form
\fIusername\fR:\fIpassword\fR@\fIserver\fR:\fIport\fR.
\fIServer\fR
is the name or IP address of a vulnerable FTP server. As with a normal URL, you may omit
\fIusername\fR:\fIpassword\fR, in which case anonymous login credentials (user:
anonymous
password:\-wwwuser@) are used. The port number (and preceding colon) may be omitted as well, in which case the default FTP port (21) on
\fIserver\fR
is used.
.sp
This vulnerability was widespread in 1997 when Nmap was released, but has largely been fixed. Vulnerable servers are still around, so it is worth trying when all else fails. If bypassing a firewall is your goal, scan the target network for open port 21 (or even for any ftp services if you scan all ports with version detection), then try a bounce scan using each. Nmap will tell you whether the host is vulnerable or not. If you are just trying to cover your tracks, you don't need to (and, in fact, shouldn't) limit yourself to hosts on the target network. Before you go scanning random Internet addresses for vulnerable FTP servers, consider that sysadmins may not appreciate you abusing their servers in this way.
.SH "PORT SPECIFICATION AND SCAN ORDER"
.PP
In addition to all of the scan methods discussed previously, Nmap offers options for specifying which ports are scanned and whether the scan order is randomized or sequential. By default, Nmap scans all ports up to and including 1024 as well as higher numbered ports listed in the
\fInmap\-services\fR
file for the protocol(s) being scanned.
.TP
\fB\-p <port ranges>\fR (Only scan specified ports)
This option specifies which ports you want to scan and overrides the default. Individual port numbers are OK, as are ranges separated by a hyphen (e.g. 1\-1023). The beginning and/or end values of a range may be omitted, causing Nmap to use 1 and 65535, respectively. So you can specify
\fB\-p\-\fR
to scan ports from 1 through 65535. Scanning port zero is allowed if you specify it explicitly. For IP protocol scanning (\fB\-sO\fR), this option specifies the protocol numbers you wish to scan for (0\-255).
.sp
When scanning both TCP and UDP ports, you can specify a particular protocol by preceding the port numbers by
T:
or
U:. The qualifier lasts until you specify another qualifier. For example, the argument
\fB\-p U:53,111,137,T:21\-25,80,139,8080\fR
would scan UDP ports 53,111,and 137, as well as the listed TCP ports. Note that to scan both UDP & TCP, you have to specify
\fB\-sU\fR
and at least one TCP scan type (such as
\fB\-sS\fR,
\fB\-sF\fR, or
\fB\-sT\fR). If no protocol qualifier is given, the port numbers are added to all protocol lists.
.TP
\fB\-F\fR (Fast (limited port) scan)
Specifies that you only wish to scan for ports listed in the
\fInmap\-services\fR
file which comes with nmap (or the protocols file for
\fB\-sO\fR). This is much faster than scanning all 65535 ports on a host. Because this list contains so many TCP ports (more than 1200), the speed difference from a default TCP scan (about 1650 ports) isn't dramatic. The difference can be enormous if you specify your own tiny
\fInmap\-services\fR
file using the
\fB\-\-datadir\fR
option.
.TP
\fB\-r\fR (Don't randomize ports)
By default, Nmap randomizes the scanned port order (except that certain commonly accessible ports are moved near the beginning for efficiency reasons). This randomization is normally desirable, but you can specify
\fB\-r\fR
for sequential port scanning instead.
.SH "SERVICE AND VERSION DETECTION"
.PP
Point Nmap at a remote machine and it might tell you that ports 25/tcp, 80/tcp, and 53/udp are open. Using its
\fInmap\-services\fR
database of about 2,200 well\-known services, Nmap would report that those ports probably correspond to a mail server (SMTP), web server (HTTP), and name server (DNS) respectively. This lookup is usually accurate \-\- the vast majority of daemons listening on TCP port 25 are, in fact, mail servers. However, you should not bet your security on this! People can and do run services on strange ports.
.PP
Even if Nmap is right, and the hypothetical server above is running SMTP, HTTP, and DNS servers, that is not a lot of information. When doing vulnerability assessments (or even simple network inventories) of your companies or clients, you really want to know which mail and DNS servers and versions are running. Having an accurate version number helps dramatically in determining which exploits a server is vulnerable to. Version detection helps you obtain this information.
.PP
After TCP and/or UDP ports are discovered using one of the other scan methods, version detection interrogates those ports to determine more about what is actually running. The
\fInmap\-service\-probes\fR
database contains probes for querying various services and match expressions to recognize and parse responses. Nmap tries to determine the service protocol (e.g. ftp, ssh, telnet, http), the application name (e.g. ISC Bind, Apache httpd, Solaris telnetd), the version number, hostname, device type (e.g. printer, router), the OS family (e.g. Windows, Linux) and sometimes miscellaneous details like whether an X server is open to connections, the SSH protocol version, or the KaZaA user name). Of course, most services don't provide all of this information. If Nmap was compiled with OpenSSL support, it will connect to SSL servers to deduce the service listening behind that encryption layer. When RPC services are discovered, the Nmap RPC grinder (\fB\-sR\fR) is automatically used to determine the RPC program and version numbers. Some UDP ports are left in the
open|filtered
state after a UDP port scan is unable to determine whether the port is open or filtered. Version detection will try to elicit a response from these ports (just as it does with open ports), and change the state to open if it succeeds.
open|filtered
TCP ports are treated the same way. Note that the Nmap
\fB\-A\fR
option enables version detection among other things. A paper documenting the workings, usage, and customization of version detection is available at
\fI\%http://www.insecure.org/nmap/vscan/\fR.
.PP
When Nmap receives responses from a service but cannot match them to its database, it prints out a special fingerprint and a URL for you to submit if to if you know for sure what is running on the port. Please take a couple minutes to make the submission so that your find can benefit everyone. Thanks to these submissions, Nmap has about 3,000 pattern matches for more than 350 protocols such as smtp, ftp, http, etc.
.PP
Version detection is enabled and controlled with the following options:
.TP
\fB\-sV\fR (Version detection)
Enables version detection, as discussed above. Alternatively, you can use
\fB\-A\fR
to enable both OS detection and version detection.
.TP
\fB\-\-allports\fR (Don't exclude any ports from version detection)
By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP get requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the
Exclude
directive in
\fInmap\-service\-probes\fR, or you can specify
\fB\-\-allports\fR
to scan all ports regardless of any
Exclude
directive.
.TP
\fB\-\-version\-intensity <intensity>\fR (Set version scan intensity)
When performing a version scan (\fB\-sV\fR), nmap sends a series of probes, each of which is assigned a rarity value between 1 and 9. The lower\-numbered probes are effective against a wide variety of common services, while the higher numbered ones are rarely useful. The intensity level specifies which probes should be applied. The higher the number, the more likely it is the service will be correctly identified. However, high intensity scans take longer. The intensity must be between 0 and 9. The default is 7. When a probe is registered to the target port via the
\fInmap\-service\-probes\fRports
directive, that probe is tried regardless of intensity level. This ensures that the DNS probes will always be attempted against any open port 53, the SSL probe will be done against 443, etc.
.TP
\fB\-\-version\-light\fR (Enable light mode)
This is a convenience alias for
\fB\-\-version\-intensity 2\fR. This light mode makes version scanning much faster, but it is slightly less likely to identify services.
.TP
\fB\-\-version\-all\fR (Try every single probe)
An alias for
\fB\-\-version\-intensity 9\fR, ensuring that every single probe is attempted against each port.
.TP
\fB\-\-version\-trace\fR (Trace version scan activity)
This causes Nmap to print out extensive debugging info about what version scanning is doing. It is a subset of what you get with
\fB\-\-packet\-trace\fR.
.TP
\fB\-sR\fR (RPC scan)
This method works in conjunction with the various port scan methods of Nmap. It takes all the TCP/UDP ports found open and floods them with SunRPC program NULL commands in an attempt to determine whether they are RPC ports, and if so, what program and version number they serve up. Thus you can effectively obtain the same info as
\fBrpcinfo \-p\fR
even if the target's portmapper is behind a firewall (or protected by TCP wrappers). Decoys do not currently work with RPC scan. This is automatically enabled as part of version scan (\fB\-sV\fR) if you request that. As version detection includes this and is much more comprehensive,
\fB\-sR\fR
is rarely needed.
.SH "OS DETECTION"
.PP
One of Nmap's best\-known features is remote OS detection using TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in the responses. After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IPID sampling, and the initial window size check, Nmap compares the results to its
\fInmap\-os\-fingerprints\fR
database of more than 1500 known OS fingerprints and prints out the OS details if there is a match. Each fingerprint includes a freeform textual description of the OS, and a classification which provides the vendor name (e.g. Sun), underlying OS (e.g. Solaris), OS generation (e.g. 10), and device type (general purpose, router, switch, game console, etc).
.PP
If Nmap is unable to guess the OS of a machine, and conditions are good (e.g. at least one open port and one closed port were found), Nmap will provide a URL you can use to submit the fingerprint if you know (for sure) the OS running on the machine. By doing this you contribute to the pool of operating systems known to Nmap and thus it will be more accurate for everyone.
.PP
OS detection enables several other tests which make use of information that is gathered during the process anyway. One of these is uptime measurement, which uses the TCP timestamp option (RFC 1323) to guess when a machine was last rebooted. This is only reported for machines which provide this information. Another is TCP Sequence Predictability Classification. This measures approximately how hard it is to establish a forged TCP connection against the remote host. It is useful for exploiting source\-IP based trust relationships (rlogin, firewall filters, etc) or for hiding the source of an attack. This sort of spoofing is rarely performed any more, but many machines are still vulnerable to it. The actual difficulty number is based on statistical sampling and may fluctuate. It is generally better to use the English classification such as
\(lqworthy challenge\(rq
or
\(lqtrivial joke\(rq. This is only reported in normal output in verbose (\fB\-v\fR) mode. When verbose mode is enabled along with
\fB\-O\fR, IPID Sequence Generation is also reported. Most machines are in the
\(lqincremental\(rq
class, which means that they increment the ID field in the IP header for each packet they send. This makes them vulnerable to several advanced information gathering and spoofing attacks.
.PP
A paper documenting the workings, usage, and customization of version detection is available in more than a dozen languages at
\fI\%http://www.insecure.org/nmap/nmap\-fingerprinting\-article.html\fR.
.PP
OS detection is enabled and controlled with the following options:
.TP
\fB\-O\fR (Enable OS detection)
Enables OS detection, as discussed above. Alternatively, you can use
\fB\-A\fR
to enable both OS detection and version detection.
.TP
\fB\-\-osscan\-limit\fR (Limit OS detection to promising targets)
OS detection is far more effective if at least one open and one closed TCP port are found. Set this option and Nmap will not even try OS detection against hosts that do not meet this criteria. This can save substantial time, particularly on
\fB\-P0\fR
scans against many hosts. It only matters when OS detection is requested with
\fB\-O\fR
or
\fB\-A\fR.
.TP
\fB\-\-osscan\-guess\fR; \fB\-\-fuzzy\fR (Guess OS detection results)
When Nmap is unable to detect a perfect OS match, it sometimes offers up near\-matches as possibilities. The match has to be very close for Nmap to do this by default. Either of these (equivalent) options make Nmap guess more aggressively. Nmap will still tell you when an imperfect match is printed and display its confidence level (percentage) for each guess.
.SH "TIMING AND PERFORMANCE"
.PP
One of my highest Nmap development priorities has always been performance. A default scan (\fBnmap \fR\fB\fIhostname\fR\fR) of a host on my local network takes a fifth of a second. That is barely enough time to blink, but adds up when you are scanning tens or hundreds of thousands of hosts. Moreover, certain scan options such as UDP scanning and version detection can increase scan times substantially. So can certain firewall configurations, particularly response rate limiting. While Nmap utilizes parallelism and many advanced algorithms to accelerate these scans, the user has ultimate control over how Nmap runs. Expert users carefully craft Nmap commands to obtain only the information they care about while meeting their time constraints.
.PP
Techniques for improving scan times include omitting non\-critical tests, and upgrading to the latest version of Nmap (performance enhancements are made frequently). Optimizing timing parameters can also make a substantial difference. Those options are listed below.
.PP
Some options accept a
time
parameter. This is specified in milliseconds by default, though you can append \(oqs\(cq, \(oqm\(cq, or \(oqh\(cq to the value to specify seconds, minutes, or hours. So the
\fB\-\-host\-timeout\fR
arguments
900000,
900s, and
15m
all do the same thing.
.TP
\fB\-\-min\-hostgroup <numhosts>\fR; \fB\-\-max\-hostgroup <numhosts>\fR (Adjust parallel scan group sizes)
Nmap has the ability to port scan or version scan multiple hosts in parallel. Nmap does this by dividing the target IP space into groups and then scanning one group at a time. In general, larger groups are more efficient. The downside is that host results can't be provided until the whole group is finished. So if Nmap started out with a group size of 50, the user would not receive any reports (except for the updates offered in verbose mode) until the first 50 hosts are completed.
.sp
By default, Nmap takes a compromise approach to this conflict. It starts out with a group size as low as five so the first results come quickly and then increases the groupsize to as high as 1024. The exact default numbers depend on the options given. For efficiency reasons, Nmap uses larger group sizes for UDP or few\-port TCP scans.
.sp
When a maximum group size is specified with
\fB\-\-max\-hostgroup\fR, Nmap will never exceed that size. Specify a minimum size with
\fB\-\-min\-hostgroup\fR
and Nmap will try to keep group sizes above that level. Nmap may have to use smaller groups than you specify if there are not enough target hosts left on a given interface to fulfill the specified minimum. Both may be set to keep the group size within a specific range, though this is rarely desired.
.sp
The primary use of these options is to specify a large minimum group size so that the full scan runs more quickly. A common choice is 256 to scan a network in Class C sized chunks. For a scan with many ports, exceeding that number is unlikely to help much. For scans of just a few port numbers, host group sizes of 2048 or more may be helpful.
.TP
\fB\-\-min\-parallelism <numprobes>\fR; \fB\-\-max\-parallelism <numprobes>\fR (Adjust probe parallelization)
These options control the total number of probes that may be outstanding for a host group. They are used for port scanning and host discovery. By default, Nmap calculates an ever\-changing ideal parallelism based on network performance. If packets are being dropped, Nmap slows down and allows fewer outstanding probes. The ideal probe number slowly rises as the network proves itself worthy. These options place minimum or maximum bounds on that variable. By default, the ideal parallelism can drop to 1 if the network proves unreliable and rise to several hundred in perfect conditions.
.sp
The most common usage is to set
\fB\-\-min\-parallelism\fR
to a number higher than one to speed up scans of poorly performing hosts or networks. This is a risky option to play with, as setting it too high may affect accuracy. Setting this also reduces Nmap's ability to control parallelism dynamically based on network conditions. A value of ten might be reasonable, though I only adjust this value as a last resort.
.sp
The
\fB\-\-max\-parallelism\fR
option is sometimes set to one to prevent Nmap from sending more than one probe at a time to hosts. This can be useful in combination with
\fB\-\-scan\-delay\fR
(discussed later), although the latter usually serves the purpose well enough by itself.
.TP
\fB\-\-min\-rtt\-timeout <time>\fR, \fB\-\-max\-rtt\-timeout <time>\fR, \fB\-\-initial\-rtt\-timeout <time>\fR (Adjust probe timeouts)
Nmap maintains a running timeout value for determining how long it will wait for a probe response before giving up or retransmitting the probe. This is calculated based on the response times of previous probes. If the network latency shows itself to be significant and variable, this timeout can grow to several seconds. It also starts at a conservative (high) level and may stay that way for a while when Nmap scans unresponsive hosts.
.sp
Specifying a lower
\fB\-\-max\-rtt\-timeout\fR
and
\fB\-\-initial\-rtt\-timeout\fR
than the defaults can cut scan times significantly. This is particularly true for pingless (\fB\-P0\fR) scans, and those against heavily filtered networks. Don't get too aggressive though. The scan can end up taking longer if you specify such a low value that many probes are timing out and retransmitting while the response is in transit.
.sp
If all the hosts are on a local network, 100 milliseconds is a reasonable aggressive
\fB\-\-max\-rtt\-timeout\fR
value. If routing is involved, ping a host on the network first with the ICMP ping utility, or with a custom packet crafter such as hping2 that is more likely to get through a firewall. Look at the maximum round trip time out of ten packets or so. You might want to double that for the
\fB\-\-initial\-rtt\-timeout\fR
and triple or quadruple it for the
\fB\-\-max\-rtt\-timeout\fR. I generally do not set the maximum rtt below 100ms, no matter what the ping times are. Nor do I exceed 1000ms.
.sp
\fB\-\-min\-rtt\-timeout\fR
is a rarely used option that could be useful when a network is so unreliable that even Nmap's default is too aggressive. Since Nmap only reduces the timeout down to the minimum when the network seems to be reliable, this need is unusual and should be reported as a bug to the nmap\-dev mailing list.
.TP
\fB\-\-max\-retries <numtries>\fR (Specify the maximum number of port scan probe retransmissions)
When Nmap receives no response to a port scan probe, it could mean the port is filtered. Or maybe the probe or response was simply lost on the network. It is also possible that the target host has rate limiting enabled that temporarily blocked the response. So Nmap tries again by retransmitting the initial probe. If Nmap detects poor network reliability, it may try many more times before giving up on a port. While this benefits accuracy, it also lengthen scan times. When performance is critical, scans may be sped up by limiting the number of retransmissions allowed. You can even specify
\fB\-\-max\-retries 0\fR
to prevent any retransmissions, though that is rarely recommended.
.sp
The default (with no
\fB\-T\fR
template) is to allow ten retransmissions. If a network seems reliable and the target hosts aren't rate limiting, Nmap usually only does one retransmission. So most target scans aren't even affected by dropping
\fB\-\-max\-retries\fR
to a low value such as three. Such values can substantially speed scans of slow (rate limited) hosts. You usually lose some information when Nmap gives up on ports early, though that may be preferable to letting the
\fB\-\-host\-timeout\fR
expire and losing all information about the target.
.TP
\fB\-\-host\-timeout <time>\fR (Give up on slow target hosts)
Some hosts simply take a
\fIlong\fR
time to scan. This may be due to poorly performing or unreliable networking hardware or software, packet rate limiting, or a restrictive firewall. The slowest few percent of the scanned hosts can eat up a majority of the scan time. Sometimes it is best to cut your losses and skip those hosts initially. Specify
\fB\-\-host\-timeout\fR
with the maximum amoung of time you are willing to wait. I often specify
30m
to ensure that Nmap doesn't waste more than half an hour on a single host. Note that Nmap may be scanning other hosts at the same time during that half an hour as well, so it isn't a complete loss. A host that times out is skipped. No port table, OS detection, or version detection results are printed for that host.
.TP
\fB\-\-scan\-delay <time>\fR; \fB\-\-max\-scan\-delay <time>\fR (Adjust delay between probes)
This option causes Nmap to wait at least the given amount of time between each probe it sends to a given host. This is particularly useful in the case of rate limiting. Solaris machines (among many others) will usually respond to UDP scan probe packets with only one ICMP message per second. Any more than that sent by Nmap will be wasteful. A
\fB\-\-scan\-delay\fR
of
1s
will keep Nmap at that slow rate. Nmap tries to detect rate limiting and adjust the scan delay accordingly, but it doesn't hurt to specify it explicitly if you already know what rate works best.
.sp
When Nmap adjusts the scan delay upward to cope with rate limiting, the scan slows down dramatically. The
\fB\-\-max\-scan\-delay\fR
option specifies the largest delay that Nmap will allow. Setting this value too low can lead to wasteful packet retransmissions and possible missed ports when the target implements strict rate limiting.
.sp
Another use of
\fB\-\-scan\-delay\fR
is to evade threshold based intrusion detection and prevention systems (IDS/IPS).
.TP
\fB\-\-defeat\-rst\-ratelimit\fR
Many hosts have long used rate limiting to reduce the number of ICMP error messages (such as port\-unreachable errors) they send. Some systems now apply similar rate limits to the RST (reset) packets they generate. This can slow Nmap down dramatically as it adjusts its timing to reflect those rate limits. You can tell Nmap to ignore those rate limits (for port scans such as SYN scan which
\fIdon't\fR
treat nonresponsive ports as
open) by specifying
\fB\-\-defeat\-rst\-ratelimit\fR.
.sp
Using this option can reduce accuracy, as some ports will appear nonresponse because Nmap didn't wait long enough for a rate\-limited RST response. With a SYN scan, the non\-response results in the port being labeled
filtered
rather than the
closed
state we see when RST packets are received. This optional is useful when you only care about open ports, and distinguishing between
closed
and
filtered
ports isn't worth the extra time.
.TP
\fB\-T <Paranoid|Sneaky|Polite|Normal|Aggressive|Insane>\fR (Set a timing template)
While the fine grained timing controls discussed in the previous section are powerful and effective, some people find them confusing. Moreover, choosing the appropriate values can sometimes take more time than the scan you are trying to optimize. So Nmap offers a simpler approach, with six timing templates. You can specify them with the
\fB\-T\fR
option and their number (0 \- 5) or their name. The template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion. Polite mode slows down the scan to use less bandwidth and target machine resources. Normal mode is the default and so
\fB\-T3\fR
does nothing. Aggressive mode speeds scans up by making the assumption that you are on a reasonably fast and reliable network. Finally Insane mode assumes that you are on an extraordinarily fast network or are willing to sacrifice some accuracy for speed.
.sp
These templates allow the user to specify how aggressive they wish to be, while leaving Nmap to pick the exact timing values. The templates also make some minor speed adjustments for which fine grained control options do not currently exist. For example,
\fB\-T4\fR
prohibits the dynamic scan delay from exceeding 10ms for TCP ports and
\fB\-T5\fR
caps that value at 5 milliseconds. Templates can be used in combination with fine grained controls, and the fine\-grained controls will you specify will take precedence over the timing template default for that parameter. I recommend using
\fB\-T4\fR
when scanning reasonably modern and reliable networks. Keep that option even when you add fine grained controls so that you benefit from those extra minor optimizations that it enables.
.sp
If you are on a decent broadband or ethernet connection, I would recommend always using
\fB\-T4\fR. Some people love
\fB\-T5\fR
though it is too aggressive for my taste. People sometimes specify
\fB\-T2\fR
because they think it is less likely to crash hosts or because they consider themselves to be polite in general. They often don't realize just how slow
\fB\-T Polite\fR
really is. Their scan may take ten times longer than a default scan. Machine crashes and bandwidth problems are rare with the default timing options (\fB\-T3\fR) and so I normally recommend that for cautious scanners. Omitting version detection is far more effective than playing with timing values at reducing these problems.
.sp
While
\fB\-T0\fR
and
\fB\-T1\fR
may be useful for avoiding IDS alerts, they will take an extraordinarily long time to scan thousands of machines or ports. For such a long scan, you may prefer to set the exact timing values you need rather than rely on the canned
\fB\-T0\fR
and
\fB\-T1\fR
values.
.sp
The main effects of
\fBT0\fR
are serializing the scan so only one port is scanned at a time, and waiting five minutes between sending each probe.
\fBT1\fR
and
\fBT2\fR
are similar but they only wait 15 seconds and 0.4 seconds, respectively, between probes.
\fBT3\fR
is Nmap's default behavior, which includes parallelization.
\fBT4\fR
does the equivalent of
\fB\-\-max\-rtt\-timeout 1250 \-\-initial\-rtt\-timeout 500 \-\-max\-retries 6\fR
and sets the maximum TCP scan delay to 10 milliseconds.
\fBT5\fR
does the equivalent of
\fB\-\-max\-rtt\-timeout 300 \-\-min\-rtt\-timeout 50 \-\-initial\-rtt\-timeout 250 \-\-max\-retries 2 \-\-host\-timeout 15m\fR
as well as setting the maximum TCP scan delay to 5ms.
.SH "FIREWALL/IDS EVASION AND SPOOFING"
.PP
Many Internet pioneers envisioned a global open network with a universal IP address space allowing virtual connections between any two nodes. This allows hosts to act as true peers, serving and retrieving information from each other. People could access all of their home systems from work, changing the climate control settings or unlocking the doors for early guests. This vision of universal connectivity has been stifled by address space shortages and security concerns. In the early 1990s, organizations began deploying firewalls for the express purpose of reducing connectivity. Huge networks were cordoned off from the unfiltered Internet by application proxies, network address translation, and packet filters. The unrestricted flow of information gave way to tight regulation of approved communication channels and the content that passes over them.
.PP
Network obstructions such as firewalls can make mapping a network exceedingly difficult. It will not get any easier, as stifling casual reconnaissance is often a key goal of implementing the devices. Nevertheless, Nmap offers many features to help understand these complex networks, and to verify that filters are working as intended. It even supports mechanisms for bypassing poorly implemented defenses. One of the best methods of understanding your network security posture is to try to defeat it. Place yourself in the mindset of an attacker, and deploy techniques from this section against your networks. Launch an FTP bounce scan, Idle scan, fragmentation attack, or try to tunnel through one of your own proxies.
.PP
In addition to restricting network activity, companies are increasingly monitoring traffic with intrusion detection systems (IDS). All of the major IDSs ship with rules designed to detect Nmap scans because scans are sometimes a precursor to attacks. Many of these products have recently morphed into intrusion
\fIprevention\fR
systems (IPS) that actively block traffic deemed malicious. Unfortunately for network administrators and IDS vendors, reliably detecting bad intentions by analyzing packet data is a tough problem. Attackers with patience, skill, and the help of certain Nmap options can usually pass by IDSs undetected. Meanwhile, administrators must cope with large numbers of false positive results where innocent activity is misdiagnosed and alerted on or blocked.
.PP
Occasionally people suggest that Nmap should not offer features for evading firewall rules or sneaking past IDSs. They argue that these features are just as likely to be misused by attackers as used by administrators to enhance security. The problem with this logic is that these methods would still be used by attackers, who would just find other tools or patch the functionality into Nmap. Meanwhile, administrators would find it that much harder to do their jobs. Deploying only modern, patched FTP servers is a far more powerful defense than trying to prevent the distribution of tools implementing the FTP bounce attack.
.PP
There is no magic bullet (or Nmap option) for detecting and subverting firewalls and IDS systems. It takes skill and experience. A tutorial is beyond the scope of this reference guide, which only lists the relevant options and describes what they do.
.TP
\fB\-f\fR (fragment packets); \fB\-\-mtu\fR (using the specified MTU)
The
\fB\-f\fR
option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets. The old\-school sniffer named Sniffit segmentation faulted immediately upon receiving the first fragment. Specify this option once, and Nmap splits the packets into 8 bytes or less after the IP header. So a 20\-byte TCP header would be split into 3 packets. Two with eight bytes of the TCP header, and one with the final four. Of course each fragment also has an IP header. Specify
\fB\-f\fR
again to use 16 bytes per fragment (reducing the number of fragments). Or you can specify your own offset size with the
\fB\-\-mtu\fR
option. Don't also specify
\fB\-f\fR
if you use
\fB\-\-mtu\fR. The offset must be a multiple of 8. While fragmented packets won't get by packet filters and firewalls that queue all IP fragments, such as the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel, some networks can't afford the performance hit this causes and thus leave it disabled. Others can't enable this because fragments may take different routes into their networks. Some source systems defragment outgoing packets in the kernel. Linux with the iptables connection tracking module is one such example. Do a scan while a sniffer such as Ethereal is running to ensure that sent packets are fragmented. If your host OS is causing problems, try the
\fB\-\-send\-eth\fR
option to bypass the IP layer and send raw ethernet frames.
.TP
\fB\-D <decoy1 [,decoy2][,ME],...>\fR (Cloak a scan with decoys)
Causes a decoy scan to be performed, which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5\-10 port scans from unique IP addresses, but they won't know which IP was scanning them and which were innocent decoys. While this can be defeated through router path tracing, response\-dropping, and other active mechanisms, it is generally an effective technique for hiding your IP address.
.sp
Separate each decoy host with commas, and you can optionally use
ME
as one of the decoys to represent the position for your real IP address. If you put
ME
in the 6th position or later, some common port scan detectors (such as Solar Designer's excellent scanlogd) are unlikely to show your IP address at all. If you don't use
ME, nmap will put you in a random position.
.sp
Note that the hosts you use as decoys should be up or you might accidentally SYN flood your targets. Also it will be pretty easy to determine which host is scanning if only one is actually up on the network. You might want to use IP addresses instead of names (so the decoy networks don't see you in their nameserver logs).
.sp
Decoys are used both in the initial ping scan (using ICMP, SYN, ACK, or whatever) and during the actual port scanning phase. Decoys are also used during remote OS detection (\fB\-O\fR). Decoys do not work with version detection or TCP connect scan.
.sp
It is worth noting that using too many decoys may slow your scan and potentially even make it less accurate. Also, some ISPs will filter out your spoofed packets, but many do not restrict spoofed IP packets at all.
.TP
\fB\-S <IP_Address>\fR (Spoof source address)
In some circumstances, Nmap may not be able to determine your source address ( Nmap will tell you if this is the case). In this situation, use
\fB\-S\fR
with the IP address of the interface you wish to send packets through.
.sp
Another possible use of this flag is to spoof the scan to make the targets think that
\fIsomeone else\fR
is scanning them. Imagine a company being repeatedly port scanned by a competitor! The
\fB\-e\fR
option would generally be required for this sort of usage, and
\fB\-P0\fR
would normally be advisable as well.
.TP
\fB\-e <interface>\fR (Use specified interface)
Tells Nmap what interface to send and receive packets on. Nmap should be able to detect this automatically, but it will tell you if it cannot.
.TP
\fB\-\-source\-port <portnumber>;\fR \fB\-g <portnumber>\fR (Spoof source port number)
One surprisingly common misconfiguration is to trust traffic based only on the source port number. It is easy to understand how this comes about. An administrator will set up a shiny new firewall, only to be flooded with complains from ungrateful users whose applications stopped working. In particular, DNS may be broken because the UDP DNS replies from external servers can no longer enter the network. FTP is another common example. In active FTP transfers, the remote server tries to establish a connection back to the client to transfer the requested file.
.sp
Secure solutions to these problems exist, often in the form of application\-level proxies or protocol\-parsing firewall modules. Unfortunately there are also easier, insecure solutions. Noting that DNS replies come from port 53 and active ftp from port 20, many admins have fallen into the trap of simply allowing incoming traffic from those ports. They often assume that no attacker would notice and exploit such firewall holes. In other cases, admins consider this a short\-term stop\-gap measure until they can implement a more secure solution. Then they forget the security upgrade.
.sp
Overworked network administrators are not the only ones to fall into this trap. Numerous products have shipped with these insecure rules. Even Microsoft has been guilty. The IPsec filters that shipped with Windows 2000 and Windows XP contain an implicit rule that allows all TCP or UDP traffic from port 88 (Kerberos). In another well\-known case, versions of the Zone Alarm personal firewall up to 2.1.25 allowed any incoming UDP packets with the source port 53 (DNS) or 67 (DHCP).
.sp
Nmap offers the
\fB\-g\fR
and
\fB\-\-source\-port\fR
options (they are equivalent) to exploit these weaknesses. Simply provide a port number and Nmap will send packets from that port where possible. Nmap must use different port numbers for certain OS detection tests to work properly, and DNS requests ignore the
\fB\-\-source\-port\fR
flag because Nmap relies on system libraries to handle those. Most TCP scans, including SYN scan, support the option completely, as does UDP scan.
.TP
\fB\-\-data\-length <number>\fR (Append random data to sent packets)
Normally Nmap sends minimalist packets containing only a header. So its TCP packets are generally 40 bytes and ICMP echo requests are just 28. This option tells Nmap to append the given number of random bytes to most of the packets it sends. OS detection (\fB\-O\fR) packets are not affected because accuracy there requires probe consistency, but most pinging and portscan packets support this. It slows things down a little, but can make a scan slightly less conspicuous.
.TP
\fB\-\-ttl <value>\fR (Set IP time\-to\-live field)
Sets the IPv4 time\-to\-live field in sent packets to the given value.
.TP
\fB\-\-randomize\-hosts\fR (Randomize target host order)
Tells Nmap to shuffle each group of up to 8096 hosts before it scans them. This can make the scans less obvious to various network monitoring systems, especially when you combine it with slow timing options. If you want to randomize over larger group sizes, increase PING_GROUP_SZ in
\fInmap.h\fR
and recompile. An alternative solution is to generate the target IP list with a list scan (\fB\-sL \-n \-oN \fR\fB\fIfilename\fR\fR), randomize it with a Perl script, then provide the whole list to Nmap with
\fB\-iL\fR.
.TP
\fB\-\-spoof\-mac <mac address, prefix, or vendor name>\fR (Spoof MAC address)
Asks Nmap to use the given MAC address for all of the raw ethernet frames it sends. This option implies
\fB\-\-send\-eth\fR
to ensure that Nmap actually sends ethernet\-level packets. The MAC given can take several formats. If it is simply the string
\(lq0\(rq, Nmap chooses a completely random MAC for the session. If the given string is an even number of hex digits (with the pairs optionally separated by a colon), Nmap will use those as the MAC. If less than 12 hex digits are provided, Nmap fills in the remainder of the 6 bytes with random values. If the argument isn't a 0 or hex string, Nmap looks through
\fInmap\-mac\-prefixes\fR
to find a vendor name containing the given string (it is case insensitive). If a match is found, Nmap uses the vendor's OUI (3\-byte prefix) and fills out the remaining 3 bytes randomly. Valid
\fB\-\-spoof\-mac\fR
argument examples are
Apple,
0,
01:02:03:04:05:06,
deadbeefcafe,
0020F2, and
Cisco.
.TP
\fB\-\-badsum\fR (Send packets with bogus TCP/UDP checksums)
Asks Nmap to use an invalid TCP or UDP checksum for packets sent to target hosts. Since virtually all host IP stacks properly drop these packets, any responses received are likely coming from a firewall or IDS that didn't bother to verify the checksum. For more details on this technique, see
\fI\%http://www.phrack.org/phrack/60/p60\-0x0c.txt\fR
.SH "OUTPUT"
.PP
Any security tools is only as useful as the output it generates. Complex tests and algorithms are of little value if they aren't presented in an organized and comprehensible fashion. Given the number of ways Nmap is used by people and other software, no single format can please everyone. So Nmap offers several formats, including the interactive mode for humans to read directly and XML for easy parsing by software.
.PP
In addition to offering different output formats, Nmap provides options for controlling the verbosity of output as well as debugging messages. Output types may be sent to standard output or to named files, which Nmap can append to or clobber. Output files may also be used to resume aborted scans.
.PP
Nmap makes output available in five different formats. The default is called
interactive output, and it is sent to standard output (stdout). There is also
normal output, which is similar to
interactive
except that it displays less runtime information and warnings since it is expected to be analyzed after the scan completes rather than interactively.
.PP
XML output is one of the most important output types, as it can be converted to HTML, easily parsed by programs such as Nmap graphical user interfaces, or imported into databases.
.PP
The two remaining output types are the simple
grepable output
which includes most information for a target host on a single line, and
sCRiPt KiDDi3 0utPUt
for users who consider themselves |<\-r4d.
.PP
While interactive output is the default and has no associated command\-line options, the other four format options use the same syntax. They take one argument, which is the filename that results should be stored in. Multiple formats may be specified, but each format may only be specified once. For example, you may wish to save normal output for your own review while saving XML of the same scan for programmatic analysis. You might do this with the options
\fB\-oX myscan.xml \-oN myscan.nmap\fR. While this chapter uses the simple names like
myscan.xml
for brevity, more descriptive names are generally recommended. The names chosen are a matter of personal preference, though I use long ones that incorporate the scan date and a word or two describing the scan, placed in a directory named after the company I'm scanning.
.PP
While these options save results to files, Nmap still prints interactive output to stdout as usual. For example, the command
\fBnmap \-oX myscan.xml target\fR
prints XML to
\fImyscan.xml\fR
and fills standard output with the same interactive results it would have printed if
\fB\-oX\fR
wasn't specified at all. You can change this by passing a hyphen character as the argument to one of the format types. This causes Nmap to deactivate interactive output, and instead print results in the format you specified to the standard output stream. So the command
\fBnmap \-oX \- target\fR
will send only XML output to stdout. Serious errors may still be printed to the normal error stream, stderr.
.PP
Unlike some Nmap arguments, the space between the logfile option flag (such as
\fB\-oX\fR) and the filename or hyphen is mandatory. If you omit the flags and give arguments such as
\fB\-oG\-\fR
or
\fB\-oXscan.xml\fR, a backwards compatibility feature of Nmap will cause the creation of
\fInormal format\fR
output files named
\fIG\-\fR
and
\fIXscan.xml\fR
respectively.
.PP
Nmap also offers options to control scan verbosity and to append to output files rather than clobbering them. All of these options are described below.
.PP
\fBNmap Output Formats\fR
.TP
\fB\-oN <filespec>\fR (Normal output)
Requests that
normal output
be directed to the given filename. As discussed above, this differs slightly from
interactive output.
.TP
\fB\-oX <filespec>\fR (XML output)
Requests that
XML output
be directed to the given filename. Nmap includes a document type definition (DTD) which allows XML parsers to validate Nmap XML output. While it is primarily intended for programmatic use, it can also help humans interpret Nmap XML output. The DTD defines the legal elements of the format, and often enumerates the attributes and values they can take on. The latest version is always available from
\fI\%http://www.insecure.org/nmap/data/nmap.dtd\fR.
.sp
XML offers a stable format that is easily parsed by software. Free XML parsers are available for all major computer languages, including C/C++, Perl, Python, and Java. People have even written bindings for most of these languages to handle Nmap output and execution specifically. Examples are
[6]\&\fINmap::Scanner\fR
and
[7]\&\fINmap::Parser\fR
in Perl CPAN. In almost all cases that a non\-trivial application interfaces with Nmap, XML is the preferred format.
.sp
The XML output references an XSL stylesheet which can be used to format the results as HTML. The easiest way to use this is simply to load the XML output in a web browser such as Firefox or IE. By default, this will only work on the machine you ran Nmap on (or a similarly configured one) due to the hard\-coded
\fInmap.xsl\fR
filesystem path. Use the
\fB\-\-webxml\fR
or
\fB\-\-stylesheet\fR
options to create portable XML files that render as HTML on any web\-connected machine.
.TP
\fB\-oS <filespec>\fR (ScRipT KIdd|3 oUTpuT)
Script kiddie output is like interactive output, except that it is post\-processed to better suit the l33t HaXXorZ who previously looked down on Nmap due to its consistent capitalization and spelling. Humor impaired people should note that this option is making fun of the script kiddies before flaming me for supposedly
\(lqhelping them\(rq.
.TP
\fB\-oG <filespec>\fR (Grepable output)
This output format is covered last because it is deprecated. The XML output format is far more powerful, and is nearly as convenient for experienced users. XML is a standard for which dozens of excellent parsers are available, while grepable output is my own simple hack. XML is extensible to support new Nmap features as they are released, while I often must omit those features from grepable output for lack of a place to put them.
.sp
Nevertheless, grepable output is still quite popular. It is a simple format that lists each host on one line and can be trivially searched and parsed with standard UNIX tools such as grep, awk, cut, sed, diff, and Perl. Even I usually use it for one\-off tests done at the command line. Finding all the hosts with the ssh port open or that are running Solaris takes only a simple grep to identify the hosts, piped to an awk or cut command to print the desired fields.
.sp
Grepable output consists of comments (lines starting with a pound (#)) and target lines. A target line includes a combination of 6 labeled fields, separated by tabs and followed with a colon. The fields are
Host,
Ports,
Protocols,
Ignored State,
OS,
Seq Index,
IPID, and
Status.
.sp
The most important of these fields is generally
Ports, which gives details on each interesting port. It is a comma separated list of port entries. Each port entry represents one interesting port, and takes the form of seven slash (/) separated subfields. Those subfields are:
Port number,
State,
Protocol,
Owner,
Service,
SunRPC info, and
Version info.
.sp
As with XML output, this man page does not allow for documenting the entire format. A more detailed look at the Nmap grepable output format is available from
\fI\%http://www.unspecific.com/nmap\-oG\-output\fR.
.TP
\fB\-oA <basename>\fR (Output to all formats)

As a convenience, you may specify
\fB\-oA \fR\fB\fIbasename\fR\fR
to store scan results in normal, XML, and grepable formats at once. They are stored in
\fIbasename\fR.nmap,
\fIbasename\fR.xml, and
\fIbasename\fR.gnmap, respectively. As with most programs, you can prefix the filenames with a directory path, such as
\fI~/nmaplogs/foocorp/\fR
on UNIX or
\fIc:\\hacking\\sco\fR
on Windows.
.PP
\fBVerbosity and debugging options\fR
.TP
\fB\-v\fR (Increase verbosity level)
Increases the verbosity level, causing Nmap to print more information about the scan in progress. Open ports are shown as they are found and completion time estimates are provided when Nmap thinks a scan will take more than a few minutes. Use it twice for even greater verbosity. Using it more than twice has no effect.
.sp
Most changes only affect interactive output, and some also affect normal and script kiddie output. The other output types are meant to be processed by machines, so Nmap can give substantial detail by default in those formats without fatiguing a human user. However, there are a few changes in other modes where output size can be reduced substantially by omitting some detail. For example, a comment line in the grepable output that provides a list of all ports scanned is only printed in verbose mode because it can be quite long.
.TP
\fB\-d [level]\fR (Increase or set debugging level)
When even verbose mode doesn't provide sufficient data for you, debugging is available to flood you with much more! As with the verbosity option (\fB\-v\fR), debugging is enabled with a command\-line flag (\fB\-d\fR) and the debug level can be increased by specifying it multiple times. Alternatively, you can set a debug level by giving an argument to
\fB\-d\fR. For example,
\fB\-d9\fR
sets level nine. That is the highest effective level and will produce thousands of lines unless you run a very simple scan with very few ports and targets.
.sp
Debugging output is useful when a bug is suspected in Nmap, or if you are simply confused as to what Nmap is doing and why. As this feature is mostly intended for developers, debug lines aren't always self\-explanatory. You may get something like:
Timeout vals: srtt: \-1 rttvar: \-1 to: 1000000 delta 14987 ==> srtt: 14987 rttvar: 14987 to: 100000. If you don't understand a line, your only recourses are to ignore it, look it up in the source code, or request help from the development list (nmap\-dev). Some lines are self explanatory, but the messages become more obscure as the debug level is increased.
.TP
\fB\-\-packet\-trace\fR (Trace packets and data sent and received)
Causes Nmap to print a summary of every packet sent or received. This is often used for debugging, but is also a valuable way for new users to understand exactly what Nmap is doing under the covers. To avoid printing thousands of lines, you may want to specify a limited number of ports to scan, such as
\fB\-p20\-30\fR. If you only care about the goings on of the version detection subsystem, use
\fB\-\-version\-trace\fR
instead.
.TP
\fB\-\-iflist\fR (List interfaces and routes)
Prints the interface list and system routes as detected by Nmap. This is useful for debugging routing problems or device mischaracterization (such as Nmap treating a PPP connection as Ethernet).
.TP
\fB\-\-log\-errors\fR (Log errors/warnings to normal mode output file)
Warnings and errors printed by Nmap usually go only to the screen (interactive output), leaving any specified normal\-fomat output files uncluttered. But when you do want to see those messages in the normal output file you specified, add this option. It is useful when you aren't watching the interactive output or are trying to debug a problem. The messages will also still appear in interactive mode. This will not work for most errors related to bad command\-line arguments, as Nmap may not have initialized its output files yet. In addition, some Nmap error/warning messages use a different system that does not yet support this option. An alternative to using this option is redirecting interactive output (including the standard error stream) to a file. While most UNIX shells make that approach easy, it can be difficult on Windows.
.PP
\fBMiscellaneous output options\fR
.TP
\fB\-\-append\-output\fR (Append to rather than clobber output files)
When you specify a filename to an output format flag such as
\fB\-oX\fR
or
\fB\-oN\fR, that file is overwritten by default. If you prefer to keep the existing content of the file and append the new results, specify the
\fB\-\-append\-output\fR
option. All output filenames specified in that Nmap execution will then be appended to rather than clobbered. This doesn't work well for XML (\fB\-oX\fR) scan data as the resultant file generally won't parse properly until you fix it up by hand.
.TP
\fB\-\-resume <filename>\fR (Resume aborted scan)
Some extensive Nmap runs take a very long time \-\- on the order of days. Such scans don't always run to completion. Restrictions may prevent Nmap from being run during working hours, the network could go down, the machine Nmap is running on might suffer a planned or unplanned reboot, or Nmap itself could crash. The admin running Nmap could cancel it for any other reason as well, by pressing
ctrl\-C. Restarting the whole scan from the beginning may be undesirable. Fortunately, if normal (\fB\-oN\fR) or grepable (\fB\-oG\fR) logs were kept, the user can ask Nmap to resume scanning with the target it was working on when execution ceased. Simply specify the
\fB\-\-resume\fR
option and pass the normal/grepable output file as its argument. No other arguments are permitted, as Nmap parses the output file to use the same ones specified previously. Simply call Nmap as
\fBnmap \-\-resume \fR\fB\fIlogfilename\fR\fR. Nmap will append new results to the data files specified in the previous execution. Resumption does not support the XML output format because combining the two runs into one valid XML file would be difficult.
.TP
\fB\-\-stylesheet <path or URL>\fR (Set XSL stylesheet to transform XML output)
Nmap ships with an XSL stylesheet named
\fInmap.xsl\fR
for viewing or translating XML output to HTML. The XML output includes an
xml\-stylesheet
directive which points to
\fInmap.xml\fR
where it was initially installed by Nmap (or in the current working directory on Windows). Simply load Nmap's XML output in a modern web browser and it should retrieve
\fInmap.xsl\fR
from the filesystem and use it to render results. If you wish to use a different stylesheet, specify it as the argument to
\fB\-\-stylesheet\fR. You must pass the full pathname or URL. One common invocation is
\fB\-\-stylesheet http://www.insecure.org/nmap/data/nmap.xsl\fR. This tells a browser to load the latest version of the stylesheet from Insecure.Org. The
\fB\-\-webxml\fR
option does the same thing with less typing and memorization. Loading the XSL from Insecure.Org makes it easier to view results on a machine that doesn't have Nmap (and thus
\fInmap.xsl\fR) installed. So the URL is often more useful, but the local filesystem location of nmap.xsl is used by default for privacy reasons.
.TP
\fB\-\-webxml\fR (Load stylesheet from Insecure.Org)
This convenience option is simply an alias for
\fB\-\-stylesheet http://www.insecure.org/nmap/data/nmap.xsl\fR.
.TP
\fB\-\-no_stylesheet\fR (Omit XSL stylesheet declaration from XML)
Specify this option to prevent Nmap from associating any XSL stylesheet with its XML output. The
xml\-stylesheet
directive is omitted.
.SH "MISCELLANEOUS OPTIONS"
.PP
This section describes some important (and not\-so\-important) options that don't really fit anywhere else.
.TP
\fB\-6\fR (Enable IPv6 scanning)
Since 2002, Nmap has offered IPv6 support for its most popular features. In particular, ping scanning (TCP\-only), connect scanning, and version detection all support IPv6. The command syntax is the same as usual except that you also add the
\fB\-6\fR
option. Of course, you must use IPv6 syntax if you specify an address rather than a hostname. An address might look like
3ffe:7501:4819:2000:210:f3ff:fe03:14d0, so hostnames are recommended. The output looks the same as usual, with the IPv6 address on the
\(lqinteresting ports\(rq
line being the only IPv6 give away.
.sp
While IPv6 hasn't exactly taken the world by storm, it gets significant use in some (usually Asian) countries and most modern operating systems support it. To use Nmap with IPv6, both the source and target of your scan must be configured for IPv6. If your ISP (like most of them) does not allocate IPv6 addresses to you, free tunnel brokers are widely available and work fine with Nmap. One of the better ones is run by BT Exact at
\fI\%https://tb.ipv6.btexact.com/\fR. I have also used one that Hurricane Electric provides at
\fI\%http://ipv6tb.he.net/\fR. 6to4 tunnels are another popular, free approach.
.TP
\fB\-A\fR (Aggressive scan options)
This option enables additional advanced and aggressive options. I haven't decided exactly which it stands for yet. Presently this enables OS Detection (\fB\-O\fR) and version scanning (\fB\-sV\fR). More features may be added in the future. The point is to enable a comprehensive set of scan options without people having to remember a large set of flags. This option only enables features, and not timing options (such as
\fB\-T4\fR) or verbosity options (\fB\-v\fR) that you might want as well.
.TP
\fB\-\-datadir <directoryname>\fR (Specify custom Nmap data file location)
Nmap obtains some special data at runtime in files named
\fInmap\-service\-probes\fR,
\fInmap\-services\fR,
\fInmap\-protocols\fR,
\fInmap\-rpc\fR,
\fInmap\-mac\-prefixes\fR, and
\fInmap\-os\-fingerprints\fR. Nmap first searches these files in the directory specified with the
\fB\-\-datadir\fR
option (if any). Any files not found there, are searched for in the directory specified by the NMAPDIR environmental variable. Next comes
\fI~/.nmap\fR
for real and effective UIDs (POSIX systems only) or location of the Nmap executable (Win32 only), and then a compiled\-in location such as
\fI/usr/local/share/nmap\fR
or
\fI/usr/share/nmap\fR
. As a last resort, Nmap will look in the current directory.
.TP
\fB\-\-send\-eth\fR (Use raw ethernet sending)
Asks Nmap to send packets at the raw ethernet (data link) layer rather than the higher IP (network) layer. By default, Nmap chooses the one which is generally best for the platform it is running on. Raw sockets (IP layer) are generally most efficient for UNIX machines, while ethernet frames are required for Windows operation since Microsoft disabled raw socket support. Nmap still uses raw IP packets on UNIX despite this option when there is no other choice (such as non\-ethernet connections).
.TP
\fB\-\-send\-ip\fR (Send at raw IP level)
Asks Nmap to send packets via raw IP sockets rather than sending lower level ethernet frames. It is the complement to the
\fB\-\-send\-eth\fR
option discussed previously.
.TP
\fB\-\-privileged\fR (Assume that the user is fully privileged)
Tells Nmap to simply assume that it is privileged enough to perform raw socket sends, packet sniffing, and similar operations that usually require root privileges on UNIX systems. By default Nmap quits if such operations are requested but geteuid() is not zero.
\fB\-\-privileged\fR
is useful with Linux kernel capabilities and similar systems that may be configured to allow unprivileged users to perform raw\-packet scans. Be sure to provide this option flag before any flags for options that require privileges (SYN scan, OS detection, etc.). The NMAP_PRIVILEGED variable may be set as an equivalent alternative to
\fB\-\-privileged\fR.
.TP
\fB\-\-interactive\fR (Start in interactive mode)
Starts Nmap in interactive mode, which offers an interactive Nmap prompt allowing easy launching of multiple scans (either synchronously or in the background). This is useful for people who scan from multi\-user systems as they often want to test their security without letting everyone else on the system know exactly which systems they are scanning. Use
\fB\-\-interactive\fR
to activate this mode and then type
h
for help. This option is rarely used because proper shells are usually more familiar and feature\-complete. This option includes a bang (!) operator for executing shell commands, which is one of many reasons not to install Nmap setuid root.
.TP
\fB\-V\fR; \fB\-\-version\fR (Print version number)
Prints the Nmap version number and exits.
.TP
\fB\-h\fR; \fB\-\-help\fR (Print help summary page)
Prints a short help screen with the most common command flags. Running Nmap without any arguments does the same thing.
.SH "RUNTIME INTERACTION"
.PP
During the execution of nmap, all key presses are captured. This allows you to interact with the program without aborting and restarting it. Certain special keys will change options, while any other keys will print out a status message telling you about the scan. The convention is that
\fIlowercase letters increase\fR
the amount of printing, and
\fIuppercase letters decrease\fR
the printing. You may also press \(oq\fI?\fR\(cq for help.
.TP
\fBv\fR / \fBV\fR
Increase / Decrease the Verbosity
.TP
\fBd\fR / \fBD\fR
Increase / Decrease the Debugging Level
.TP
\fBp\fR / \fBP\fR
Turn on / off Packet Tracing
.TP
\fB?\fR
Print a runtime interaction help screen
.TP
Anything else
Print out a status message like this:
.sp
Stats: 0:00:08 elapsed; 111 hosts completed (5 up), 5 undergoing Service Scan
.sp
Service scan Timing: About 28.00% done; ETC: 16:18 (0:00:15 remaining)
.SH "EXAMPLES"
.PP
Here are some Nmap usage examples, from the simple and routine to a little more complex and esoteric. Some actual IP addresses and domain names are used to make things more concrete. In their place you should substitute addresses/names from
\fIyour own network.\fR. While I don't think port scanning other networks is or should be illegal, some network administrators don't appreciate unsolicited scanning of their networks and may complain. Getting permission first is the best approach.
.PP
For testing purposes, you have permission to scan the host
scanme.nmap.org. This permission only includes scanning via Nmap and not testing exploits or denial of service attacks. To conserve bandwidth, please do not initiate more than a dozen scans against that host per day. If this free scanning target service is abused, it will be taken down and Nmap will report
Failed to resolve given hostname/IP: scanme.nmap.org. These permissions also apply to the hosts
scanme2.nmap.org,
scanme3.nmap.org, and so on, though those hosts do not currently exist.
.PP
\fBnmap \-v scanme.nmap.org\fR
.PP
This option scans all reserved TCP ports on the machine
scanme.nmap.org
. The
\fB\-v\fR
option enables verbose mode.
.PP
\fBnmap \-sS \-O scanme.nmap.org/24\fR
.PP
Launches a stealth SYN scan against each machine that is up out of the 255 machines on
\(lqclass C\(rq
network where Scanme resides. It also tries to determine what operating system is running on each host that is up and running. This requires root privileges because of the SYN scan and OS detection.
.PP
\fBnmap \-sV \-p 22,53,110,143,4564 198.116.0\-255.1\-127\fR
.PP
Launches host enumeration and a TCP scan at the first half of each of the 255 possible 8 bit subnets in the 198.116 class B address space. This tests whether the systems run sshd, DNS, pop3d, imapd, or port 4564. For any of these ports found open, version detection is used to determine what application is running.
.PP
\fBnmap \-v \-iR 100000 \-P0 \-p 80\fR
.PP
Asks Nmap to choose 100,000 hosts at random and scan them for web servers (port 80). Host enumeration is disabled with
\fB\-P0\fR
since first sending a couple probes to determine whether a host is up is wasteful when you are only probing one port on each target host anyway.
.PP
\fBnmap \-P0 \-p80 \-oX logs/pb\-port80scan.xml \-oG logs/pb\-port80scan.gnmap 216.163.128.20/20\fR
.PP
This scans 4096 IPs for any webservers (without pinging them) and saves the output in grepable and XML formats.
.SH "BUGS"
.PP
Like its author, Nmap isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nmap doesn't behave the way you expect, first upgrade to the latest version available from
\fI\%http://www.insecure.org/nmap/\fR. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try Googling the error message or browsing the Nmap\-dev archives at
\fI\%http://seclists.org/\fR. Read this full munaual page as well. If nothing comes of this, mail a bug report to
<nmap\-dev@insecure.org>. Please include everything you have learned about the problem, as well as what version of Nmap you are running and what operating system version it is running on. Problem reports and Nmap usage questions sent to nmap\-dev@insecure.org are far more likely to be answered than those sent to Fyodor directly.
.PP
Code patches to fix bugs are even better than bug reports. Basic instructions for creating patch files with your changes are available at
\fI\%http://www.insecure.org/nmap/data/HACKING\fR. Patches may be sent to nmap\-dev (recommended) or to Fyodor directly.
.SH "AUTHOR"
.PP
Fyodor
<fyodor@insecure.org>
(\fI\%http://www.insecure.org\fR)
.PP
Hundreds of people have made valuable contributions to Nmap over the years. These are detailed in the
\fICHANGELOG\fR
file which is distributed with Nmap and also available from
\fI\%http://www.insecure.org/nmap/changelog.html\fR.
.SH "LEGAL NOTICES"
.SS "Nmap Copyright and Licensing"
.PP
The Nmap Security Scanner is (C) 1996\-2005 Insecure.Com LLC. Nmap is also a registered trademark of Insecure.Com LLC. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed Nmap technology into proprietary software, we may be willing to sell alternative licenses (contact
<sales@insecure.com>). Many security scanner vendors already license Nmap technology such as host discovery, port scanning, OS detection, and service/version detection.
.PP
Note that the GPL places important restrictions on
\(lqderived works\(rq, yet it does not provide a detailed definition of that term. To avoid misunderstandings, we consider an application to constitute a
\(lqderivative work\(rq
for the purpose of this license if it does any of the following:
.TP 3
\(bu
Integrates source code from Nmap
.TP
\(bu
Reads or includes Nmap copyrighted data files, such as
\fInmap\-os\-fingerprints\fR
or
\fInmap\-service\-probes\fR.
.TP
\(bu
Executes Nmap and parses the results (as opposed to typical shell or execution\-menu apps, which simply display raw Nmap output and so are not derivative works.)
.TP
\(bu
Integrates/includes/aggregates Nmap into a proprietary executable installer, such as those produced by InstallShield.
.TP
\(bu
Links to a library or executes a program that does any of the above.
.PP
The term
\(lqNmap\(rq
should be taken to also include any portions or derived works of Nmap. This list is not exclusive, but is just meant to clarify our interpretation of derived works with some common examples. These restrictions only apply when you actually redistribute Nmap. For example, nothing stops you from writing and selling a proprietary front\-end to Nmap. Just distribute it by itself, and point people to
\fI\%http://www.insecure.org/nmap/\fR
to download Nmap.
.PP
We don't consider these to be added restrictions on top of the GPL, but just a clarification of how we interpret
\(lqderived works\(rq
as it applies to our GPL\-licensed Nmap product. This is similar to the way Linus Torvalds has announced his interpretation of how
\(lqderived works\(rq
applies to Linux kernel modules. Our interpretation refers only to Nmap \- we don't speak for any other GPL products.
.PP
If you have any questions about the GPL licensing restrictions on using Nmap in non\-GPL works, we would be happy to help. As mentioned above, we also offer alternative license to integrate Nmap into proprietary applications and appliances. These contracts have been sold to many security vendors, and generally include a perpetual license as well as providing for priority support and updates as well as helping to fund the continued development of Nmap technology. Please email
<sales@insecure.com>
for further information.
.PP
As a special exception to the GPL terms, Insecure.Com LLC grants permission to link the code of this program with any version of the OpenSSL library which is distributed under a license identical to that listed in the included Copying.OpenSSL file, and distribute linked combinations including the two. You must obey the GNU GPL in all respects for all of the code used other than OpenSSL. If you modify this file, you may extend this exception to your version of the file, but you are not obligated to do so.
.PP
If you received these files with a written license agreement or contract stating terms other than the terms above, then that alternative license agreement takes precedence over these comments.
.SS "Creative Commons license for this Nmap guide"
.PP
This Nmap Reference Guide is (C) 2005 Insecure.Com LLC. It is hereby placed under version 2.5 of the
[8]\&\fICreative Commons Attribution License\fR. This allows you redistribute and modify the work as you desire, as long as you credit the original source. Alternatively, you may choose to treat this document as falling under the same license as Nmap itself (discussed previously).
.SS "Source code availability and community contributions"
.PP
Source is provided to this software because we believe users have a right to know exactly what a program is going to do before they run it. This also allows you to audit the software for security holes (none have been found so far).
.PP
Source code also allows you to port Nmap to new platforms, fix bugs, and add new features. You are highly encouraged to send your changes to
<fyodor@insecure.org>
for possible incorporation into the main distribution. By sending these changes to Fyodor or one of the Insecure.Org development mailing lists, it is assumed that you are offering Fyodor and Insecure.Com LLC the unlimited, non\-exclusive right to reuse, modify, and relicense the code. Nmap will always be available Open Source, but this is important because the inability to relicense code has caused devastating problems for other Free Software projects (such as KDE and NASM). We also occasionally relicense the code to third parties as discussed above. If you wish to specify special license conditions of your contributions, just say so when you send them.
.SS "No Warranty"
.PP
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details at
\fI\%http://www.gnu.org/copyleft/gpl.html\fR, or in the COPYING file included with Nmap.
.PP
It should also be noted that Nmap has occasionally been known to crash poorly written applications, TCP/IP stacks, and even operating systems. While this is extremely rare, it is important to keep in mind.
\fINmap should never be run against mission critical systems\fR
unless you are prepared to suffer downtime. We acknowledge here that Nmap may crash your systems or networks and we disclaim all liability for any damage or problems Nmap could cause.
.SS "Inappropriate Usage"
.PP
Because of the slight risk of crashes and because a few black hats like to use Nmap for reconnaissance prior to attacking systems, there are administrators who become upset and may complain when their system is scanned. Thus, it is often advisable to request permission before doing even a light scan of a network.
.PP
Nmap should never be installed with special privileges (e.g. suid root) for security reasons.
.SS "Third\-Party Software"
.PP
This product includes software developed by the
[9]\&\fIApache Software Foundation\fR. A modified version of the
[10]\&\fILibpcap portable packet capture library\fR
is distributed along with nmap. The Windows version of Nmap utilized the libpcap\-derived
[11]\&\fIWinPcap library\fR
instead. Regular expression support is provided by the
[12]\&\fIPCRE library\fR, which is open source software, written by Philip Hazel. Certain raw networking functions use the
[13]\&\fILibdnet\fR
networking library, which was written by Dug Song. A modified version is distributed with Nmap. Nmap can optionally link with the
[14]\&\fIOpenSSL cryptography toolkit\fR
for SSL version detection support. All of the third\-party software described in this paragraph is freely redistributable under BSD\-style software licenses.
.SS "US Export Control Classification"
.PP
US Export Control: Insecure.Com LLC believes that Nmap falls under US ECCN (export control classification number) 5D992. This category is called
\(lqInformation Security software not controlled by 5D002\(rq. The only restriction of this classification is AT (anti\-terrorism), which applies to almost all goods and denies export to a handful of rogue nations such as Iran and North Korea. Thus exporting Nmap does not require any special license, permit, or other governmental authorization.
.SH "REFERENCES"
.TP 4
 1.\ RFC 1122
\%http://www.rfc\-editor.org/rfc/rfc1122.txt
.TP 4
 2.\ RFC 792
\%http://www.rfc\-editor.org/rfc/rfc792.txt
.TP 4
 3.\ UDP
\%http://www.rfc\-editor.org/rfc/rfc768.txt
.TP 4
 4.\ TCP RFC
\%http://www.rfc\-editor.org/rfc/rfc793.txt
.TP 4
 5.\ RFC 959
\%http://www.rfc\-editor.org/rfc/rfc959.txt
.TP 4
 6.\ Nmap::Scanner
\%http://sourceforge.net/projects/nmap\-scanner/
.TP 4
 7.\ Nmap::Parser
\%http://www.nmapparser.com
.TP 4
 8.\ Creative Commons Attribution License
\%http://creativecommons.org/licenses/by/2.5/
.TP 4
 9.\ Apache Software Foundation
\%http://www.apache.org
.TP 4
10.\ Libpcap portable packet capture library
\%http://www.tcpdump.org
.TP 4
11.\ WinPcap library
\%http://www.winpcap.org
.TP 4
12.\ PCRE library
\%http://www.pcre.org
.TP 4
13.\ Libdnet
\%http://libdnet.sourceforge.net
.TP 4
14.\ OpenSSL cryptography toolkit
\%http://www.openssl.org
  07070100243ff4000041ed0000000a0000000a0000000344fe8f2800000000000000880000000a00000000000000000000000c00000005reloc/share   07070100243ff5000041ed0000000a0000000a0000000244fe8f2800000000000000880000000a00000000000000000000001100000005reloc/share/nmap  07070100243ff6000081a40000000a0000000a0000000144fe8f250003710a000000880000000a00000000000000000000002300000005reloc/share/nmap/nmap-mac-prefixes    # $Id: nmap-mac-prefixes 3413 2006-06-01 00:39:02Z fyodor $ generated with make-mac-prefixes.pl
# Original data comes from http://standards.ieee.org/regauth/oui/oui.txt
# These values are known as Organizationally Unique Identifiers (OUIs)
# See http://standards.ieee.org/faqs/OUI.html
# We have added a few unregistered OUIs at the end.
000000 Xerox
000001 Xerox
000002 Xerox
000003 Xerox
000004 Xerox
000005 Xerox
000006 Xerox
000007 Xerox
000008 Xerox
000009 Xerox
00000A Omron Tateisi Electronics CO.
00000B Matrix
00000C Cisco Systems
00000D Fibronics
00000E Fujitsu Limited
00000F NEXT
000010 Sytek
000011 Normerel Systemes
000012 Information Technology Limited
000013 Camex
000014 Netronix
000015 Datapoint
000016 DU Pont Pixel Systems
000017 Tekelec
000018 Webster Computer
000019 Applied Dynamics International
00001A Advanced Micro Devices
00001B Novell
00001C Bell Technologies
00001D Cabletron Systems
00001E Telsist Industria Electronica
00001F Telco Systems
000020 Dataindustrier Diab AB
000021 Sureman COMP. & Commun.
000022 Visual Technology
000023 ABB Industrial Systems AB
000024 Connect AS
000025 Ramtek
000026 Sha-ken CO.
000027 Japan Radio Company
000028 Prodigy Systems
000029 IMC Networks
00002A TRW - Sedd/inp
00002B Crisp Automation
00002C Autotote Limited
00002D Chromatics
00002E Societe Evira
00002F Timeplex
000030 VG Laboratory Systems
000031 Qpsx Communications
000032 Marconi plc
000033 Egan Machinery Company
000034 Network Resources
000035 Spectragraphics
000036 Atari
000037 Oxford Metrics Limited
000038 CSS Labs
000039 Toshiba
00003A Chyron
00003B i Controls
00003C Auspex Systems
00003D Unisys
00003E Simpact
00003F Syntrex
000040 Applicon
000041 ICE
000042 Metier Management Systems
000043 Micro Technology
000044 Castelle
000045 Ford Aerospace & COMM.
000046 Olivetti North America
000047 Nicolet Instruments
000048 Seiko Epson
000049 Apricot Computers
00004A ADC Codenoll Technology
00004B ICL Data OY
00004C NEC
00004D DCI
00004E Ampex
00004F Logicraft
000050 Radisys
000051 HOB Electronic Gmbh & CO. KG
000052 Intrusion.com
000053 Compucorp
000054 Modicon
000055 Commissariat A L`energie ATOM.
000056 DR. B. Struck
000057 Scitex
000058 Racore Computer Products
000059 Hellige Gmbh
00005A SysKonnect GmbH
00005B Eltec Elektronik AG
00005C Telematics International
00005D CS Telecom
00005E USC Information Sciences Inst
00005F Sumitomo Electric IND.
000060 Kontron Elektronik Gmbh
000061 Gateway Communications
000062 Bull HN Information Systems
000063 Barco Control Rooms Gmbh
000064 Yokogawa Digital Computer
000065 Network General
000066 Talaris Systems
000067 Soft * RITE
000068 Rosemount Controls
000069 Concord Communications
00006A Computer Consoles
00006B Silicon Graphics/mips
00006C Private
00006D Cray Communications
00006E Artisoft
00006F Madge
000070 HCL Limited
000071 Adra Systems
000072 Miniware Technology
000073 Siecor
000074 Ricoh Company
000075 Nortel Networks
000076 Abekas Video System
000077 Interphase
000078 Labtam Limited
000079 Networth Incorporated
00007A Dana Computer
00007B Research Machines
00007C Ampere Incorporated
00007D SUN Microsystems
00007E Clustrix
00007F Linotype-hell AG
000080 Cray Communications A/S
000081 BAY Networks
000082 Lectra Systemes SA
000083 Tadpole Technology PLC
000084 Supernet
000085 Canon
000086 Megahertz
000087 Hitachi
000088 Computer Network TECH.
000089 Cayman Systems
00008A Datahouse Information Systems
00008B Infotron
00008C Alloy Computer Products (Australia)
00008D Verdix
00008E Solbourne Computer
00008F Raytheon Company
000090 Microcom
000091 Anritsu
000092 Cogent Data Technologies
000093 Proteon
000094 Asante Technologies
000095 Sony Tektronix
000096 Marconi Electronics
000097 Epoch Systems
000098 Crosscomm
000099 MTX
00009A RC Computer A/S
00009B Information International
00009C Rolm Mil-spec Computers
00009D Locus Computing
00009E Marli S.A.
00009F Ameristar Technologies
0000A0 Sanyo Electric Co.
0000A1 Marquette Electric CO.
0000A2 BAY Networks
0000A3 Network Application Technology
0000A4 Acorn Computers Limited
0000A5 Compatible Systems
0000A6 Network General
0000A7 Network Computing Devices
0000A8 Stratus Computer
0000A9 Network Systems
0000AA Xerox
0000AB Logic Modeling
0000AC Conware Computer Consulting
0000AD Bruker Instruments
0000AE Dassault Electronique
0000AF Nuclear Data Instrumentation
0000B0 Rnd-rad Network Devices
0000B1 Alpha Microsystems
0000B2 Televideo Systems
0000B3 Cimlinc Incorporated
0000B4 Edimax Computer Company
0000B5 Datability Software SYS.
0000B6 Micro-matic Research
0000B7 Dove Computer
0000B8 Seikosha CO.
0000B9 Mcdonnell Douglas Computer SYS
0000BA SIIG
0000BB Tri-data
0000BC Allen-bradley CO.
0000BD Mitsubishi Cable Company
0000BE THE NTI Group
0000BF Symmetric Computer Systems
0000C0 Western Digital
0000C1 Madge
0000C2 Information Presentation TECH.
0000C3 Harris Computer SYS DIV
0000C4 Waters DIV. OF Millipore
0000C5 Farallon Computing/netopia
0000C6 EON Systems
0000C7 Arix
0000C8 Altos Computer Systems
0000C9 Emulex
0000CA Arris International
0000CB Compu-shack Electronic Gmbh
0000CC Densan CO.
0000CD Allied Telesyn Research
0000CE Megadata
0000CF Hayes Microcomputer Products
0000D0 Develcon Electronics
0000D1 Adaptec Incorporated
0000D2 SBE
0000D3 Wang Laboratories
0000D4 Pure Data
0000D5 Micrognosis International
0000D6 Punch Line Holding
0000D7 Dartmouth College
0000D8 Novell
0000D9 Nippon Telegraph & Telephone
0000DA Atex
0000DB British Telecommunications PLC
0000DC Hayes Microcomputer Products
0000DD TCL Incorporated
0000DE Cetia
0000DF Bell & Howell PUB SYS DIV
0000E0 Quadram
0000E1 Grid Systems
0000E2 Acer Technologies
0000E3 Integrated Micro Products
0000E4 IN2 Groupe Intertechnique
0000E5 Sigmex
0000E6 Aptor Produits DE Comm Indust
0000E7 Star Gate Technologies
0000E8 Accton Technology
0000E9 Isicad
0000EA Upnod AB
0000EB Matsushita COMM. IND. CO.
0000EC Microprocess
0000ED April
0000EE Network Designers
0000EF KTI
0000F0 Samsung Electronics CO.
0000F1 Magna Computer
0000F2 Spider Communications
0000F3 Gandalf Data Limited
0000F4 Allied Telesyn International
0000F5 Diamond Sales Limited
0000F6 Applied Microsystems
0000F7 Youth Keep Enterprise CO
0000F8 Digital Equipment
0000F9 Quotron Systems
0000FA Microsage Computer Systems
0000FB Rechner ZUR Kommunikation
0000FC Meiko
0000FD High Level Hardware
0000FE Annapolis Micro Systems
0000FF Camtec Electronics
000100 Equip'trans
000101 Private
000102 3com
000103 3com
000104 Dvico Co.
000105 Beckhoff Gmbh
000106 Tews Datentechnik GmbH
000107 Leiser GmbH
000108 Avlab Technology
000109 Nagano Japan Radio Co.
00010A CIS Technology
00010B Space CyberLink
00010C System Talks
00010D Coreco
00010E Bri-Link Technologies Co.
00010F McDATA
000110 Gotham Networks
000111 iDigm
000112 Shark Multimedia
000113 Olympus
000114 Kanda Tsushin Kogyo CO.
000115 Extratech
000116 Netspect Technologies
000117 Canal
000118 EZ Digital Co.
000119 Action Controls
00011A EEH DataLink GmbH
00011B Unizone Technologies
00011C Universal Talkware
00011D Centillium Communications
00011E Precidia Technologies
00011F RC Networks
000120 Oscilloquartz S.A.
000121 Watchguard Technologies
000122 Trend Communications
000123 Digital Electronics
000124 Acer Incorporated
000125 Yaesu Musen CO.
000126 PAC Labs
000127 Open Networks
000128 EnjoyWeb
000129 DFI
00012A Telematica Sistems Inteligente
00012B Telenet Co.
00012C Aravox Technologies
00012D Komodo Technology
00012E PC Partner
00012F Twinhead International
000130 Extreme Networks
000131 Detection Systems
000132 Dranetz - BMI
000133 Kyowa Electronic Instruments
000134 SIG Positec Systems AG
000135 KDC
000136 CyberTAN Technology
000137 IT Farm
000138 XAVi Technologies
000139 Point Multimedia Systems
00013A Shelcad Communications
00013B BNA Systems
00013C TIW Systems
00013D RiscStation
00013E Ascom Tateco AB
00013F Neighbor World Co.
000140 Sendtek
000141 Cable Print
000142 Cisco Systems
000143 Cisco Systems
000144 EMC
000145 Winsystems
000146 Tesco Controls
000147 Zhone Technologies
000148 X-traWeb
000149 T.D.T. Transfer Data Test GmbH
00014A Sony
00014B Ennovate Networks
00014C Berkeley Process Control
00014D Shin Kin Enterprises Co.
00014E WIN Enterprises
00014F Adtran
000150 Gilat Communications
000151 Ensemble Communications
000152 Chromatek
000153 Archtek Telecom
000154 G3M
000155 Promise Technology
000156 Firewiredirect.com
000157 Syswave CO.
000158 Electro Industries/Gauge Tech
000159 S1
00015A Digital Video Broadcasting
00015B Italtel S.p.a/rf-up-i
00015C Cadant
00015D Sun Microsystems
00015E Best Technology CO.
00015F Digital Design Gmbh
000160 Elmex Co.
000161 Meta Machine Technology
000162 Cygnet Technologies
000163 Cisco Systems
000164 Cisco Systems
000165 AirSwitch
000166 TC Group A/S
000167 Hioki E.E.
000168 Vitana
000169 Celestix Networks Pte
00016A Alitec
00016B LightChip
00016C Foxconn
00016D CarrierComm
00016E Conklin
00016F Haitai Electronics CO.
000170 ESE Embedded System Engineer'g
000171 Allied Data Technologies
000172 TechnoLand Co.
000173 Amcc
000174 CyberOptics
000175 Radiant Communications
000176 Orient Silver Enterprises
000177 Edsl
000178 Margi Systems
000179 Wireless Technology
00017A Chengdu Maipu Electric Industrial Co.
00017B Heidelberger Druckmaschinen AG
00017C AG-E GmbH
00017D ThermoQuest
00017E Adtek System Science Co.
00017F Experience Music Project
000180 AOpen
000181 Nortel Networks
000182 Dica Technologies AG
000183 Anite Telecoms
000184 Sieb & Meyer AG
000185 Aloka Co.
000186 Disch Gmbh
000187 i2SE GmbH
000188 Lxco Technologies ag
000189 Refraction Technology
00018A ROI Computer AG
00018B NetLinks Co.
00018C Mega Vision
00018D AudeSi Technologies
00018E Logitec
00018F Kenetec
000190 Smk-m
000191 Syred Data Systems
000192 Texas Digital Systems
000193 Hanbyul Telecom Co.
000194 Capital Equipment
000195 Sena Technologies
000196 Cisco Systems
000197 Cisco Systems
000198 Darim Vision
000199 HeiSei Electronics
00019A Leunig Gmbh
00019B Kyoto Microcomputer Co.
00019C JDS Uniphase
00019D E-Control Systems
00019E ESS Technology
00019F Phonex Broadband
0001A0 Infinilink
0001A1 Mag-Tek
0001A2 Logical Co.
0001A3 Genesys Logic
0001A4 Microlink
0001A5 Nextcomm
0001A6 Scientific-Atlanta Arcodan A/S
0001A7 Unex Technology
0001A8 Welltech Computer Co.
0001A9 BMW AG
0001AA Airspan Communications
0001AB Main Street Networks
0001AC Sitara Networks
0001AD Coach Master International  d.b.a. CMI Worldwide
0001AE Trex Enterprises
0001AF Motorola Computer Group
0001B0 Fulltek Technology Co.
0001B1 General Bandwidth
0001B2 Digital Processing Systems
0001B3 Precision Electronic Manufacturing
0001B4 Wayport
0001B5 Turin Networks
0001B6 Saejin T&M Co.
0001B7 Centos
0001B8 Netsensity
0001B9 SKF Condition Monitoring
0001BA IC-Net
0001BB Frequentis
0001BC Brains
0001BD Peterson Electro-Musical Products
0001BE Gigalink Co.
0001BF Teleforce Co.
0001C0 CompuLab
0001C1 Vitesse Semiconductor
0001C2 ARK Research
0001C3 Acromag
0001C4 NeoWave
0001C5 Simpler Networks
0001C6 Quarry Technologies
0001C7 Cisco Systems
0001C8 Thomas Conrad
0001C8 Conrad
0001C9 Cisco Systems
0001CA Geocast Network Systems
0001CB EVR
0001CC Japan Total Design Communication Co.
0001CD ARtem
0001CE Custom Micro Products
0001CF Alpha Data Parallel Systems
0001D0 VitalPoint
0001D1 CoNet Communications
0001D2 MacPower Peripherals
0001D3 Paxcomm
0001D4 Leisure Time
0001D5 Haedong Info & Comm CO.
0001D6 MAN Roland Druckmaschinen AG
0001D7 F5 Networks
0001D8 Teltronics
0001D9 Sigma
0001DA Wincomm
0001DB Freecom Technologies GmbH
0001DC Activetelco
0001DD Avail Networks
0001DE Trango Systems
0001DF Isdn Communications
0001E0 Fast Systems
0001E1 Kinpo Electronics
0001E2 Ando Electric
0001E3 Siemens AG
0001E4 Sitera
0001E5 Supernet
0001E6 Hewlett-Packard Company
0001E7 Hewlett-Packard Company
0001E8 Force10 Networks
0001E9 Litton Marine Systems B.V.
0001EA Cirilium
0001EB C-COM
0001EC Ericsson Group
0001ED Seta
0001EE Comtrol Europe
0001EF Camtel Technology
0001F0 Tridium
0001F1 Innovative Concepts
0001F2 Mark of the Unicorn
0001F3 QPS
0001F4 Enterasys Networks
0001F5 Erim S.A.
0001F6 Association of Musical Electronics Industry
0001F7 Image Display Systems
0001F8 Adherent Systems
0001F9 TeraGlobal Communications
0001FA Horoscas
0001FB DoTop Technology
0001FC Keyence
0001FD Digital Voice Systems
0001FE Digital Equipment
0001FF Data Direct Networks
000200 Net & Sys Co.
000201 IFM Electronic gmbh
000202 Amino Communications
000203 Woonsang Telecom
000204 Bodmann Industries Elektronik GmbH
000205 Hitachi Denshi
000206 Telital R&D Denmark A/S
000207 VisionGlobal Network
000208 Unify Networks
000209 Shenzhen SED Information Technology Co.
00020A Gefran Spa
00020B Native Networks
00020C Metro-Optix
00020D Micronpc.com
00020E Laurel Networks
00020F Aatr
000210 Fenecom
000211 Nature Worldwide Technology
000212 SierraCom
000213 S.d.e.l.
000214 Dtvro
000215 Cotas Computer Technology A/B
000216 Cisco Systems
000217 Cisco Systems
000218 Advanced Scientific
000219 Paralon Technologies
00021A Zuma Networks
00021B Kollmorgen-Servotronix
00021C Network Elements
00021D Data General Communication
00021E Simtel S.r.l.
00021F Aculab PLC
000220 Canon Aptex
000221 DSP Application
000222 Chromisys
000223 ClickTV
000224 C-cor
000225 Certus Technology
000226 XESystems
000227 ESD GmbH
000228 Necsom
000229 Adtec
00022A Asound Electronic
00022B SAXA
00022C ABB Bomem
00022D Agere Systems
00022E Teac R&
00022F P-Cube
000230 Intersoft Electronics
000231 Ingersoll-Rand
000232 Avision
000233 Mantra Communications
000234 Imperial Technology
000235 Paragon Networks International
000236 Init Gmbh
000237 Cosmo Research
000238 Serome Technology
000239 Visicom
00023A ZSK Stickmaschinen GmbH
00023B Redback Networks
00023C Creative Technology
00023D NuSpeed
00023E Selta Telematica S.p.a
00023F Compal Electronics
000240 Seedek Co.
000241 Amer.com
000242 Videoframe Systems
000243 Raysis Co.
000244 Surecom Technology Co.
000245 Lampus Co
000246 All-Win Tech Co.
000247 Great Dragon Information Technology (Group) Co.
000248 Pilz GmbH & Co.
000249 Aviv Infocom Co
00024A Cisco Systems
00024B Cisco Systems
00024C SiByte
00024D Mannesman Dematic Colby
00024E Datacard Group
00024F IPM Datacom S.R.L.
000250 Geyser Networks
000251 Soma Networks
000252 Carrier
000253 Televideo
000254 WorldGate
000255 IBM
000256 Alpha Processor
000257 Microcom
000258 Flying Packets Communications
000259 Tsann Kuen China (Shanghai)Enterprise Co., IT Group
00025A Catena Networks
00025B Cambridge Silicon Radio
00025C SCI Systems (Kunshan) Co.
00025D Calix Networks
00025E High Technology
00025F Nortel Networks
000260 Accordion Networks
000261 i3 Micro Technology AB
000262 Soyo Group Soyo Com Tech Co.
000263 UPS Manufacturing SRL
000264 AudioRamp.com
000265 Virditech Co.
000266 Thermalogic
000267 Node Runner
000268 Harris Government Communications
000269 Nadatel Co.
00026A Cocess Telecom Co.
00026B BCM Computers Co.
00026C Philips CFT
00026D Adept Telecom
00026E NeGeN Access
00026F Senao International Co.
000270 Crewave Co.
000271 Vpacket Communications
000272 CC&C Technologies
000273 Coriolis Networks
000274 Tommy Technologies
000275 Smart Technologies
000276 Primax Electronics
000277 Cash Systemes Industrie
000278 Samsung Electro-Mechanics Co.
000279 Control Applications
00027A IOI Technology
00027B Amplify Net
00027C Trilithic
00027D Cisco Systems
00027E Cisco Systems
00027F ask-technologies.com
000280 Mu Net
000281 Madge
000282 ViaClix
000283 Spectrum Controls
000284 Areva T&D
000285 Riverstone Networks
000286 Occam Networks
000287 Adapcom
000288 Global Village Communication
000289 DNE Technologies
00028A Ambit Microsystems
00028B Vdsl Systems OY
00028C Micrel-Synergy Semiconductor
00028D Movita Technologies
00028E Rapid 5 Networks
00028F Globetek
000290 Woorigisool
000291 Open Network Co.
000292 Logic Innovations
000293 Solid Data Systems
000294 Tokyo Sokushin Co.
000295 IP.Access Limited
000296 Lectron Co
000297 C-COR.net
000298 Broadframe
000299 Apex
00029A Storage Apps
00029B Kreatel Communications AB
00029C 3com
00029D Merix
00029E Information Equipment Co.
00029F L-3 Communication Aviation Recorders
0002A0 Flatstack
0002A1 World Wide Packets
0002A2 Hilscher GmbH
0002A3 ABB Power Automation
0002A4 AddPac Technology Co.
0002A5 Compaq Computer
0002A6 Effinet Systems Co.
0002A7 Vivace Networks
0002A8 Air Link Technology
0002A9 Racom, S.r.o.
0002AA PLcom Co.
0002AB CTC Union Technologies Co.
0002AC 3PAR data
0002AD Pentax Corpotation
0002AE Scannex Electronics
0002AF TeleCruz Technology
0002B0 Hokubu Communication & Industrial Co.
0002B1 Anritsu
0002B2 Cablevision
0002B3 Intel
0002B4 Daphne
0002B5 Avnet
0002B6 Acrosser Technology Co.
0002B7 Watanabe Electric Industry Co.
0002B8 WHI Konsult AB
0002B9 Cisco Systems
0002BA Cisco Systems
0002BB Continuous Computing
0002BC LVL 7 Systems
0002BD Bionet Co.
0002BE Totsu Engineering
0002BF dotRocket
0002C0 Bencent Tzeng Industry Co.
0002C1 Innovative Electronic Designs
0002C2 Net Vision Telecom
0002C3 Arelnet
0002C4 Vector International Buba
0002C5 Evertz Microsystems
0002C6 Data Track Technology PLC
0002C7 Alps Electric Co.
0002C8 Technocom Communications Technology (pte)
0002C9 Mellanox Technologies
0002CA EndPoints
0002CB TriState
0002CC M.c.c.i
0002CD TeleDream
0002CE FoxJet
0002CF ZyGate Communications
0002D0 Comdial
0002D1 Vivotek
0002D2 Workstation AG
0002D3 NetBotz
0002D4 PDA Peripherals
0002D5 ACR
0002D6 Nice Systems
0002D7 Empeg
0002D8 Brecis Communications
0002D9 Reliable Controls
0002DA ExiO Communications
0002DB Netsec
0002DC Fujitsu General Limited
0002DD Bromax Communications
0002DE Astrodesign
0002DF Net Com Systems
0002E0 Etas Gmbh
0002E1 Integrated Network
0002E2 NDC Infared Engineering
0002E3 Lite-on Communications
0002E4 JC Hyun Systems
0002E5 Timeware
0002E6 Gould Instrument Systems
0002E7 CAB GmbH & Co KG
0002E8 E.d.&a.
0002E9 CS Systemes De Securite - C3S
0002EA Focus Enhancements
0002EB Pico Communications
0002EC Maschoff Design Engineering
0002ED DXO Telecom Co.
0002EE Nokia Danmark A/S
0002EF CCC Network Systems Group
0002F0 AME Optimedia Technology Co.
0002F1 Pinetron Co.
0002F2 eDevice
0002F3 Media Serve Co.
0002F4 Pctel
0002F5 Vive Synergies
0002F6 Equipe Communications
0002F7 ARM
0002F8 Seakr Engineering
0002F9 Mimos Semiconductor SDN BHD
0002FA DX Antenna Co.
0002FB Baumuller Aulugen-Systemtechnik GmbH
0002FC Cisco Systems
0002FD Cisco Systems
0002FE Viditec
0002FF Handan BroadInfoCom
000300 NetContinuum
000301 Avantas Networks
000302 Charles Industries
000303 Jama Electronics Co.
000304 Pacific Broadband Communications
000305 Smart Network Devices GmbH
000306 Fusion In Tech Co.
000307 Secure Works
000308 AM Communications
000309 Texcel Technology PLC
00030A Argus Technologies
00030B Hunter Technology
00030C Telesoft Technologies
00030D Uniwill Computer
00030E Core Communications Co.
00030F Digital China (Shanghai) Networks
000310 Link Evolution
000311 Micro Technology Co.
000312 TR-Systemtechnik GmbH
000313 Access Media SPA
000314 Teleware Network Systems
000315 Cidco Incorporated
000316 Nobell Communications
000317 Merlin Systems
000318 Cyras Systems
000319 Infineon AG
00031A Beijing Broad Telecom
00031B Cellvision Systems
00031C Svenska Hardvarufabriken AB
00031D Taiwan Commate Computer
00031E Optranet
00031F Condev
000320 Xpeed
000321 Reco Research Co.
000322 Idis Co.
000323 Cornet Technology
000324 Sanyo Multimedia Tottori Co.
000325 Arima Computer
000326 Iwasaki Information Systems Co.
000327 Act'l
000328 Mace Group
000329 F3
00032A UniData Communication Systems
00032B GAI Datenfunksysteme GmbH
00032C ABB Industrie AG
00032D Ibase Technology
00032E Scope Information Management
00032F Global Sun Technology
000330 Imagenics, Co.
000331 Cisco Systems
000332 Cisco Systems
000333 Digitel Co.
000334 Newport Electronics
000335 Mirae Technology
000336 Zetes Technologies
000337 Vaone
000338 Oak Technology
000339 Eurologic Systems
00033A Silicon Wave
00033B Tami Tech Co.
00033C Daiden Co.
00033D Ilshin Lab
00033E Tateyama System Laboratory Co.
00033F BigBand Networks
000340 Floware Wireless Systems
000341 Axon Digital Design
000342 Nortel Networks
000343 Martin Professional A/S
000344 Tietech.Co.
000345 Routrek Networks
000346 Hitachi Kokusai Electric
000347 Intel
000348 Norscan Instruments
000349 Vidicode Datacommunicatie B.V.
00034A Rias
00034B Nortel Networks
00034C Shanghai DigiVision Technology Co.
00034D Chiaro Networks
00034E Pos Data Company
00034F Sur-Gard Security
000350 Bticino SPA
000351 Diebold
000352 Colubris Networks
000353 Mitac
000354 Fiber Logic Communications
000355 TeraBeam Internet Systems
000356 Wincor Nixdorf GmbH & Co KG
000357 Intervoice-Brite
000358 Hanyang Digitech Co.
000359 DigitalSis
00035A Photron Limited
00035B BridgeWave Communications
00035C Saint Song
00035D Bosung Hi-Net Co.
00035E Metropolitan Area Networks
00035F Prueftechnik Condition Monitoring GmbH & Co. KG
000360 PAC Interactive Technology
000361 Widcomm
000362 Vodtel Communications
000363 Miraesys Co.
000364 Scenix Semiconductor
000365 Kira Information & Communications
000366 ASM Pacific Technology
000367 Jasmine Networks
000368 Embedone Co.
000369 Nippon Antenna Co.
00036A Mainnet
00036B Cisco Systems
00036C Cisco Systems
00036D Runtop
00036E Nicon Systems (Pty) Limited
00036F Telsey SPA
000370 NXTV
000371 Acomz Networks
000372 Ulan
000373 Aselsan A.S
000374 Hunter Watertech
000375 NetMedia
000376 Graphtec Technology
000377 Gigabit Wireless
000378 Humax Co.
000379 Proscend Communications
00037A Taiyo Yuden Co.
00037B Idec Izumi
00037C Coax Media
00037D Stellcom
00037E Portech Communications
00037F Atheros Communications
000380 SSH Communications Security
000381 Ingenico International
000382 A-One Co.
000383 Metera Networks
000384 Aeta
000385 Actelis Networks
000386 Ho Net
000387 Blaze Network Products
000388 Fastfame Technology Co.
000389 Plantronics
00038A America Online
00038B Plus-one I&T
00038C Total Impact
00038D PCS Revenue Control Systems
00038E Atoga Systems
00038F Weinschel
000390 Digital Video Communications
000391 Advanced Digital Broadcast
000392 Hyundai Teletek Co.
000393 Apple Computer
000394 Connect One
000395 California Amplifier
000396 EZ Cast Co.
000397 Watchfront Electronics
000398 Wisi
000399 Dongju Informations & Communications Co.
00039A nSine
00039B NetChip Technology
00039C OptiMight Communications
00039D Benq
00039E Tera System Co.
00039F Cisco Systems
0003A0 Cisco Systems
0003A1 Hiper Information & Communication
0003A2 Catapult Communications
0003A3 Mavix
0003A4 Data Storage and Information Management
0003A5 Medea
0003A6 Traxit Technology
0003A7 Unixtar Technology
0003A8 Idot Computers
0003A9 Axcent Media AG
0003AA Watlow
0003AB Bridge Information Systems
0003AC Fronius Schweissmaschinen
0003AD Emerson Energy Systems AB
0003AE Allied Advanced Manufacturing Pte
0003AF Paragea Communications
0003B0 Xsense Technology
0003B1 Hospira
0003B2 Radware
0003B3 IA Link Systems Co.
0003B4 Macrotek International
0003B5 Entra Technology Co.
0003B6 QSI
0003B7 Zaccess Systems
0003B8 NetKit Solutions
0003B9 Hualong Telecom Co.
0003BA Sun Microsystems
0003BB Signal Communications Limited
0003BC COT GmbH
0003BD OmniCluster Technologies
0003BE Netility
0003BF Centerpoint Broadband Technologies
0003C0 Rftnc Co.
0003C1 Packet Dynamics
0003C2 Solphone K.K.
0003C3 Micronik Multimedia
0003C4 Tomra Systems ASA
0003C5 Mobotix AG
0003C6 Icue Systems
0003C7 hopf Elektronik GmbH
0003C8 CML Emergency Services
0003C9 Tecom Co.
0003CA MTS Systems
0003CB Nippon Systems Development Co.
0003CC Momentum Computer
0003CD Clovertech
0003CE Eten Technologies
0003CF Muxcom
0003D0 Koankeiso Co.
0003D1 Takaya
0003D2 Crossbeam Systems
0003D3 Internet Energy Systems
0003D4 Alloptic
0003D5 Advanced Communications Co.
0003D6 Radvision
0003D7 NextNet Wireless
0003D8 iMPath Networks
0003D9 Secheron SA
0003DA Takamisawa Cybernetics Co.
0003DB Apogee Electronics
0003DC Lexar Media
0003DD Comark
0003DE OTC Wireless
0003DF Desana Systems
0003E0 RadioFrame Networks
0003E1 Winmate Communication
0003E2 Comspace
0003E3 Cisco Systems
0003E4 Cisco Systems
0003E5 Hermstedt SG
0003E6 Entone Technologies
0003E7 Logostek Co.
0003E8 Wavelength Digital Limited
0003E9 Akara Canada
0003EA Mega System Technologies
0003EB Atrica
0003EC ICG Research
0003ED Shinkawa Electric Co.
0003EE MKNet
0003EF Oneline AG
0003F0 Redfern Broadband Networks
0003F1 Cicada Semiconductor
0003F2 Seneca Networks
0003F3 Dazzle Multimedia
0003F4 NetBurner
0003F5 Chip2Chip
0003F6 Allegro Networks
0003F7 Plast-Control GmbH
0003F8 SanCastle Technologies
0003F9 Pleiades Communications
0003FA TiMetra Networks
0003FB Toko Seiki Company
0003FC Intertex Data AB
0003FD Cisco Systems
0003FE Cisco Systems
0003FF Microsoft
000400 Lexmark International
000401 Osaki Electric Co.
000402 Nexsan Technologies
000403 Nexsi
000404 Makino Milling Machine Co.
000405 ACN Technologies
000406 Fa. Metabox AG
000407 Topcon Positioning Systems
000408 Sanko Electronics Co.
000409 Cratos Networks
00040A Sage Systems
00040B 3com Europe
00040C Kanno Work's
00040D Avaya
00040E AVM GmbH
00040F Asus Network Technologies
000410 Spinnaker Networks
000411 Inkra Networks
000412 WaveSmith Networks
000413 Snom Technology AG
000414 Umezawa Musen Denki Co.
000415 Rasteme Systems Co.
000416 Parks S/A Comunicacoes Digitais
000417 Elau AG
000418 TeltronicU.
000419 Fibercycle Networks
00041A ines GmbH
00041B Digital Interfaces
00041C ipDialog
00041D Corega of America
00041E Shikoku Instrumentation Co.
00041F Sony Computer Entertainment
000420 Slim Devices
000421 Ocular Networks
000422 Gordon Kapes
000423 Intel
000424 TMC s.r.l.
000425 Atmel
000426 Autosys
000427 Cisco Systems
000428 Cisco Systems
000429 Pixord
00042A Wireless Networks
00042B IT Access Co.
00042C Minet
00042D Sarian Systems
00042E Netous Technologies
00042F International Communications Products
000430 Netgem
000431 GlobalStreams
000432 Voyetra Turtle Beach
000433 Cyberboard A/S
000434 Accelent Systems
000435 Comptek International
000436 Elansat Technologies
000437 Powin Information Technology
000438 Nortel Networks
000439 Rosco Entertainment Technology
00043A Intelligent Telecommunications
00043B Lava Computer Mfg.
00043C Sonos Co.
00043D Indel AG
00043E Telencomm
00043F Electronic Systems Technology
000440 cyberPIXIE
000441 Half Dome Systems
000442 Nact
000443 Agilent Technologies
000444 Western Multiplex
000445 LMS Skalar Instruments GmbH
000446 Cyzentech Co.
000447 Acrowave Systems Co.
000448 Polaroid Professional Imaging
000449 Mapletree Networks
00044A iPolicy Networks
00044B Nvidia
00044C Jenoptik
00044D Cisco Systems
00044E Cisco Systems
00044F Leukhardt Systemelektronik GmbH
000450 DMD Computers SRL
000451 Medrad
000452 RocketLogix
000453 YottaYotta
000454 Quadriga UK
000455 Antara.net
000456 PipingHot Networks
000457 Universal Access Technology
000458 Fusion X Co.
000459 Veristar
00045A The Linksys Group
00045B Techsan Electronics Co.
00045C Mobiwave Pte
00045D Beka Elektronik
00045E PolyTrax Information Technology AG
00045F Evalue Technology
000460 Knilink Technology
000461 Epox Computer Co.
000462 Dakos Data & Communication Co.
000463 Bosch Security Systems
000464 Fantasma Networks
000465 i.s.t isdn-support technik GmbH
000466 Armitel Co.
000467 Wuhan Research Institute of MII
000468 Vivity
000469 Innocom
00046A Navini Networks
00046B Palm Wireless
00046C Cyber Technology Co.
00046D Cisco Systems
00046E Cisco Systems
00046F Digitel S/A Industria Eletronica
000470 ipUnplugged AB
000471 IPrad
000472 Telelynx
000473 Photonex
000474 Legrand
000475 3 Com
000476 3 Com
000477 Scalant Systems
000478 G. Star Technology
000479 Radius Co.
00047A Axxessit ASA
00047B Schlumberger
00047C Skidata AG
00047D Pelco
00047E Optelecom=NKF
00047F Chr. Mayr GmbH & Co. KG
000480 Foundry Networks
000481 Econolite Control Products
000482 Medialogic
000483 Deltron Technology
000484 Amann GmbH
000485 PicoLight
000486 ITTC, University of Kansas
000487 Cogency Semiconductor
000488 Eurotherm Controls
000489 Yafo Networks
00048A Temia Vertriebs GmbH
00048B Poscon
00048C Nayna Networks
00048D Tone Commander Systems
00048E Ohm Tech Labs
00048F TD Systems
000490 Optical Access
000491 Technovision
000492 Hive Internet
000493 Tsinghua Unisplendour Co.
000494 Breezecom
000495 Tejas Networks
000496 Extreme Networks
000497 MacroSystem Digital Video AG
000498 Mahi Networks
000499 Chino
00049A Cisco Systems
00049B Cisco Systems
00049C Surgient Networks
00049D Ipanema Technologies
00049E Wirelink Co.
00049F Metrowerks
0004A0 Verity Instruments
0004A1 Pathway Connectivity
0004A2 L.S.I. Japan Co.
0004A3 Microchip Technology
0004A4 NetEnabled
0004A5 Barco Projection Systems NV
0004A6 SAF Tehnika
0004A7 FabiaTech
0004A8 Broadmax Technologies
0004A9 SandStream Technologies
0004AA Jetstream Communications
0004AB Comverse Network Systems
0004AC IBM
0004AD Malibu Networks
0004AE Liquid Metronics
0004AF Digital Fountain
0004B0 Elesign Co.
0004B1 Signal Technology
0004B2 Essegi SRL
0004B3 Videotek
0004B4 Ciac
0004B5 Equitrac
0004B6 Stratex Networks
0004B7 AMB i.t. Holding
0004B8 Kumahira Co.
0004B9 S.I. Soubou
0004BA KDD Media Will
0004BB Bardac
0004BC Giantec
0004BD Motorola BCS
0004BE OptXCon
0004BF VersaLogic
0004C0 Cisco Systems
0004C1 Cisco Systems
0004C2 Magnipix
0004C3 Castor Informatique
0004C4 Allen & Heath Limited
0004C5 ASE Technologies
0004C6 Yamaha Motor Co.
0004C7 NetMount
0004C8 Liba Maschinenfabrik Gmbh
0004C9 Micro Electron Co.
0004CA FreeMs
0004CB Tdsoft Communication
0004CC Peek Traffic B.V.
0004CD Informedia Research Group
0004CE Patria Ailon
0004CF Seagate Technology
0004D0 Softlink s.r.o.
0004D1 Drew Technologies
0004D2 Adcon Telemetry GmbH
0004D3 Toyokeiki Co.
0004D4 Proview Electronics Co.
0004D5 Hitachi Communication Systems
0004D6 Takagi Industrial Co.
0004D7 Omitec Instrumentation
0004D8 IPWireless
0004D9 Titan Electronics
0004DA Relax Technology
0004DB Tellus Group
0004DC Nortel Networks
0004DD Cisco Systems
0004DE Cisco Systems
0004DF Teracom Telematica Ltda.
0004E0 Procket Networks
0004E1 Infinior Microsystems
0004E2 SMC Networks
0004E3 Accton Technology
0004E4 Daeryung Ind.
0004E5 Glonet Systems
0004E6 Banyan Network Private Limited
0004E7 Lightpointe Communications
0004E8 IER
0004E9 Infiniswitch
0004EA Hewlett-Packard Company
0004EB Paxonet Communications
0004EC Memobox SA
0004ED Billion Electric Co.
0004EE Lincoln Electric Company
0004EF Polestar
0004F0 International Computers
0004F1 WhereNet
0004F2 Polycom
0004F3 FS Forth-systeme Gmbh
0004F4 Infinite Electronics
0004F5 SnowShore Networks
0004F6 Amphus
0004F7 Omega Band
0004F8 Qualicable TV Industria E Com.
0004F9 Xtera Communications
0004FA NBS Technologies
0004FB Commtech
0004FC Stratus Computer (DE)
0004FD Japan Control Engineering Co.
0004FE Pelago Networks
0004FF Acronet Co.
000500 Cisco Systems
000501 Cisco Systems
000502 Apple Computer
000503 Iconag
000504 Naray Information & Communication Enterprise
000505 Systems Integration Solutions
000506 Reddo Networks AB
000507 Fine Appliance
000508 Inetcam
000509 Avoc Nishimura
00050A ICS Spa
00050B Sicom Systems
00050C Network Photonics
00050D Midstream Technologies
00050E 3ware
00050F Tanaka S/S
000510 Infinite Shanghai Communication Terminals
000511 Complementary Technologies
000512 MeshNetworks
000513 VTLinx Multimedia Systems
000514 KDT Systems Co.
000515 Nuark Co.
000516 Smart Modular Technologies
000517 Shellcomm
000518 Jupiters Technology
000519 Siemens Building Technologies AG,
00051A 3Com Europe
00051B Magic Control Technology
00051C Xnet Technology
00051D Airocon
00051E Brocade Communications Systems
00051F Taijin Media Co.
000520 Smartronix
000521 Control Microsystems
000522 LEA*D
000523 AVL List GmbH
000524 BTL System (HK) Limited
000525 Puretek Industrial Co.
000526 Ipas Gmbh
000527 SJ Tek Co.
000528 New Focus
000529 Shanghai Broadan Communication Technology Co.
00052A Ikegami Tsushinki Co.
00052B Horiba
00052C Supreme Magic
00052D Zoltrix International Limited
00052E Cinta Networks
00052F Leviton Voice and Data
000530 Andiamo Systems
000531 Cisco Systems
000532 Cisco Systems
000533 Sanera Systems
000534 Northstar Engineering
000535 Chip PC
000536 Danam Communications
000537 Nets Technology Co.
000538 Merilus
000539 A Brand New World in Sweden AB
00053A Willowglen Services Pte
00053B Harbour Networks, Co. Beijing
00053C Xircom
00053D Agere Systems
00053E KID Systeme GmbH
00053F VisionTek
000540 Fast
000541 Advanced Systems Co.
000542 Otari
000543 IQ Wireless GmbH
000544 Valley Technologies
000545 Internet Photonics
000546 Kddi Network & Solultions
000547 Starent Networks
000548 Disco
000549 Salira Optical Network Systems
00054A Ario Data Networks
00054B Micro Innovation AG
00054C RF Innovations
00054D Brans Technologies
00054E Philips Components
00054F Private
000550 Vcomms Limited
000551 F & S Elektronik Systeme GmbH
000552 Xycotec Computer GmbH
000553 DVC Company
000554 Rangestar Wireless
000555 Japan Cash Machine Co.
000556 360 Systems
000557 Agile TV
000558 Synchronous
000559 Intracom S.A.
00055A Power Dsine
00055B Charles Industries
00055C Kowa Company
00055D D-Link Systems
00055E Cisco Systems
00055F Cisco Systems
000560 Leader Comm.co.
000561 nac Image Technology
000562 Digital View Limited
000563 J-Works
000564 Tsinghua Bitway Co.
000565 Tailyn Communication Company
000566 Secui.com
000567 Etymonic Design
000568 Piltofish Networks AB
000569 Vmware
00056A Heuft Systemtechnik GmbH
00056B C.P. Technology Co.
00056C Hung Chang Co.
00056D Pacific
00056E National Enhance Technology
00056F Innomedia Technologies Pvt.
000570 Baydel
000571 Seiwa Electronics Co.
000572 Deonet Co.
000573 Cisco Systems
000574 Cisco Systems
000575 CDS-Electronics BV
000576 NSM Technology
000577 SM Information & Communication
000578 Private
000579 Universal Control Solution
00057A Hatteras Networks
00057B Chung Nam Electronic Co.
00057C RCO Security AB
00057D Sun Communications
00057E Eckelmann Steuerungstechnik GmbH
00057F Acqis Technology
000580 Fibrolan
000581 Snell & Wilcox
000582 ClearCube Technology
000583 ImageCom Limited
000584 AbsoluteValue Systems
000585 Juniper Networks
000586 Lucent Technologies
000587 Locus, Incorporated
000588 Sensoria
000589 National Datacomputer
00058A Netcom Co.
00058B IPmental
00058C Opentech
00058D Lynx Photonic Networks
00058E Flextronics International GmbH & Co. Nfg. KG
00058F CLCsoft co.
000590 Swissvoice
000591 Active Silicon
000592 Pultek
000593 Grammar Engine
000594 Ixxat Automation Gmbh
000595 Alesis
000596 Genotech Co.
000597 Eagle Traffic Control Systems
000598 Cronos S.r.l.
000599 DRS Test and Energy Management or DRS-TEM
00059A Cisco Systems
00059B Cisco Systems
00059C Kleinknecht GmbH, Ing. Buero
00059D Daniel Computing Systems
00059E Zinwell
00059F Yotta Networks
0005A0 Mobiline Kft.
0005A1 Zenocom
0005A2 Celox Networks
0005A3 QEI
0005A4 Lucid Voice
0005A5 Kott
0005A6 Extron Electronics
0005A7 Hyperchip
0005A8 Wyle Electronics
0005A9 Princeton Networks
0005AA Moore Industries International
0005AB Cyber Fone
0005AC Northern Digital
0005AD Topspin Communications
0005AE Mediaport USA
0005AF InnoScan Computing A/S
0005B0 Korea Computer Technology Co.
0005B1 ASB Technology BV
0005B2 Medison Co.
0005B3 Asahi-Engineering Co.
0005B4 Aceex
0005B5 Broadcom Technologies
0005B6 Insys Microelectronics Gmbh
0005B7 Arbor Technology
0005B8 Electronic Design Associates
0005B9 Airvana
0005BA Area Netwoeks
0005BB Myspace AB
0005BC Resorsys
0005BD Roax BV
0005BE Kongsberg Seatex AS
0005BF JustEzy Technology
0005C0 Digital Network Alacarte Co.
0005C1 A-Kyung Motion
0005C2 Soronti
0005C3 Pacific Instruments
0005C4 Telect
0005C5 Flaga HF
0005C6 Triz Communications
0005C7 I/f-com A/S
0005C8 Verytech
0005C9 LG Innotek
0005CA Hitron Technology
0005CB Rois Technologies
0005CC Sumtel Communications
0005CD Denon
0005CE Prolink Microsystems
0005CF Thunder River Technologies
0005D0 Solinet Systems
0005D1 Metavector Technologies
0005D2 DAP Technologies
0005D3 eProduction Solutions
0005D4 FutureSmart Networks
0005D5 Speedcom Wireless
0005D6 Titan Wireless
0005D7 Vista Imaging
0005D8 Arescom
0005D9 Techno Valley
0005DA Apex Automationstechnik
0005DB Nentec GmbH
0005DC Cisco Systems
0005DD Cisco Systems
0005DE Gi Fone Korea
0005DF Electronic Innovation
0005E0 Empirix
0005E1 Trellis Photonics
0005E2 Creativ Network Technologies
0005E3 LightSand Communications
0005E4 Red Lion Controls L.P.
0005E5 Renishaw PLC
0005E6 Egenera
0005E7 Netrake
0005E8 TurboWave
0005E9 Unicess Network
0005EA Rednix
0005EB Blue Ridge Networks
0005EC Mosaic Systems
0005ED Technikum Joanneum GmbH
0005EE Bewator Group
0005EF Adoir Digital Technology
0005F0 Satec
0005F1 Vrcom
0005F2 Power
0005F3 Weboyn
0005F4 System Base Co.
0005F5 OYO Geospace
0005F6 Young Chang Co.
0005F7 Analog Devices
0005F8 Real Time Access
0005F9 TOA
0005FA IPOptical
0005FB ShareGate
0005FC Schenck Pegasus
0005FD PacketLight Networks
0005FE Traficon N.V.
0005FF SNS Solutions
000600 Toshiba Teli
000601 Otanikeiki Co.
000602 Cirkitech Electronics Co.
000603 Baker Hughes
000604 @Track Communications
000605 Inncom International
000606 RapidWAN
000607 Omni Directional Control Technology
000608 At-Sky SAS
000609 Crossport Systems
00060A Blue2space
00060B Paceline Systems
00060C Melco Industries
00060D Wave7 Optics
00060E Igys Systems
00060F Narad Networks
000610 Abeona Networks
000611 Zeus Wireless
000612 Accusys
000613 Kawasaki Microelectronics Incorporated
000614 Prism Holdings
000615 Kimoto Electric Co.
000616 Tel Net Co.
000617 Redswitch
000618 DigiPower Manufacturing
000619 Connection Technology Systems
00061A Zetari
00061B Portable Systems, IBM Japan Co
00061C Hoshino Metal Industries
00061D MIP Telecom
00061E Maxan Systems
00061F Vision Components GmbH
000620 Serial System
000621 Hinox, Co.
000622 Chung Fu Chen Yeh Enterprise
000623 MGE UPS Systems France
000624 Gentner Communications
000625 The Linksys Group
000626 MWE GmbH
000627 Uniwide Technologies
000628 Cisco Systems
000629 IBM
00062A Cisco Systems
00062B Intraserver Technology
00062C Network Robots
00062D TouchStar Technologies, L.L.C.
00062E Aristos Logic
00062F Pivotech Systems
000630 Adtranz Sweden
000631 Optical Solutions
000632 Mesco Engineering GmbH
000633 Smiths Heimann Biometric Systems
000634 GTE Airfone
000635 PacketAir Networks
000636 Jedai Broadband Networks
000637 Toptrend-Meta Information (ShenZhen)
000638 Sungjin C&C Co.
000639 Newtec
00063A Dura Micro
00063B Arcturus Networks
00063C NMI Electronics
00063D Microwave Data Systems
00063E Opthos
00063F Everex Communications
000640 White Rock Networks
000641 Itcn
000642 Genetel Systems
000643 Sono Computer Co.
000644 Neix
000645 Meisei Electric Co.
000646 ShenZhen XunBao Network Technology Co
000647 Etrali S.A.
000648 Seedsware
000649 Quante
00064A Honeywell Co., (korea)
00064B Alexon Co.
00064C Invicta Networks
00064D Sencore
00064E Broad Net Technology
00064F Pro-nets Technology
000650 Tiburon Networks
000651 Aspen Networks
000652 Cisco Systems
000653 Cisco Systems
000654 Maxxio Technologies
000655 Yipee
000656 Tactel AB
000657 Market Central
000658 Helmut Fischer GmbH & Co. KG
000659 EAL (Apeldoorn) B.V.
00065A Strix Systems
00065B Dell Computer
00065C Malachite Technologies
00065D Heidelberg Web Systems
00065E Photuris
00065F ECI Telecom - Ngts
000660 Nadex Co.
000661 NIA Home Technologies
000662 MBM Technology
000663 Human Technology Co.
000664 Fostex
000665 Sunny Giken
000666 Roving Networks
000667 Tripp Lite
000668 Vicon Industries
000669 Datasound Laboratories
00066A InfiniCon Systems
00066B Sysmex
00066C Robinson
00066D Compuprint S.P.A.
00066E Delta Electronics
00066F Korea Data Systems
000670 Upponetti Oy
000671 Softing AG
000672 Netezza
000673 Optelecom-nkf
000674 Spectrum Control
000675 Banderacom
000676 Novra Technologies
000677 Sick AG
000678 Marantz Japan
000679 Konami
00067A JMP Systems
00067B Toplink C&C
00067C Cisco Systems
00067D Takasago
00067E WinCom Systems
00067F Rearden Steel Technologies
000680 Card Access
000681 Goepel Electronic GmbH
000682 Convedia
000683 Bravara Communications
000684 Biacore AB
000685 NetNearU
000686 Zardcom Co.
000687 Omnitron Systems Technology
000688 Telways Communication Co.
000689 yLez Technologies Pte
00068A NeuronNet Co. R&D Center
00068B AirRunner Technologies
00068C 3Com
00068D Sepaton
00068E HID
00068F Telemonitor
000690 Euracom Communication GmbH
000691 PT Inovacao
000692 Intruvert Networks
000693 Flexus Computer Technology
000694 Mobillian
000695 Ensure Technologies
000696 Advent Networks
000697 R & D Center
000698 egnite Software GmbH
000699 Vida Design Co.
00069A e & Tel
00069B AVT Audio Video Technologies GmbH
00069C Transmode Systems AB
00069D Petards Mobile Intelligence
00069E Uniqa
00069F Kuokoa Networks
0006A0 Mx Imaging
0006A1 Celsian Technologies
0006A2 Microtune
0006A3 Bitran
0006A4 Innowell
0006A5 Pinon
0006A6 Artistic Licence (UK)
0006A7 Primarion
0006A8 KC Technology
0006A9 Universal Instruments
0006AA Miltope
0006AB W-Link Systems
0006AC Intersoft Co.
0006AD KB Electronics
0006AE Himachal Futuristic Communications
0006AF Private
0006B0 Comtech EF Data
0006B1 Sonicwall
0006B2 Linxtek Co.
0006B3 Diagraph
0006B4 Vorne Industries
0006B5 Luminent
0006B6 Nir-Or Israel
0006B7 Telem Gmbh
0006B8 Bandspeed
0006B9 A5TEK
0006BA Westwave Communications
0006BB ATI Technologies
0006BC Macrolink
0006BD Bntechnology Co.
0006BE Baumer Optronic GmbH
0006BF Accella Technologies Co.
0006C0 United Internetworks
0006C1 Cisco Systems
0006C2 Smartmatic
0006C3 Schindler Elevators
0006C4 Piolink
0006C5 Innovi Technologies Limited
0006C6 lesswire AG
0006C7 Rfnet Technologies Pte (S)
0006C8 Sumitomo Metal Micro Devices
0006C9 Technical Marketing Research
0006CA American Computer & Digital Components, (acdc)
0006CB Jotron Electronics A/S
0006CC JMI Electronics Co.
0006CD Creo IL.
0006CE Dateno
0006CF Thales Avionics In-Flight Systems
0006D0 Elgar Electronics
0006D1 Tahoe Networks
0006D2 Tundra Semiconductor
0006D3 Alpha Telecom, U.S.A.
0006D4 Interactive Objects
0006D5 Diamond Systems
0006D6 Cisco Systems
0006D7 Cisco Systems
0006D8 Maple Optical Systems
0006D9 IPM-Net S.p.A.
0006DA Itran Communications
0006DB Ichips Co.
0006DC Syabas Technology (Amquest)
0006DD AT & T Laboratories - Cambridge
0006DE Flash Technology
0006DF Aidonic
0006E0 MAT Co.
0006E1 Techno Trade s.a
0006E2 Ceemax Technology Co.
0006E3 Quantitative Imaging
0006E4 Citel Technologies
0006E5 Fujian Newland Computer Co.
0006E6 DongYang Telecom Co.
0006E7 Bit Blitz Communications
0006E8 Optical Network Testing
0006E9 Intime
0006EA Elzet80 Mikrocomputer Gmbh&co. KG
0006EB Global Data
0006EC M/A COM Private Radio System
0006ED Inara Networks
0006EE Shenyang Neu-era Information & Technology Stock Co.
0006EF Maxxan Systems
0006F0 Digeo
0006F1 Optillion
0006F2 Platys Communications
0006F3 AcceLight Networks
0006F4 Prime Electronics & Satellitics
0006F8 Private
0006F9 Mitsui Zosen Systems Research
0006FA IP Square Co
0006FB Hitachi Printing Solutions
0006FC Fnet Co.
0006FD Comjet Information Systems
0006FE Celion Networks
0006FF Sheba Systems Co.
000700 Zettamedia Korea
000701 Racal-datacom
000702 Varian Medical Systems
000703 Csee Transport
000705 Endress & Hauser GmbH & Co
000706 Sanritz
000707 Interalia
000708 Bitrage
000709 Westerstrand Urfabrik AB
00070A Unicom Automation Co.
00070B Octal
00070C SVA-Intrusion.com Co.
00070D Cisco Systems
00070E Cisco Systems
00070F Fujant
000710 Adax
000711 Acterna
000712 JAL Information Technology
000713 IP One
000714 Brightcom
000715 General Research of Electronics
000716 J & S Marine
000717 Wieland Electric GmbH
000718 iCanTek Co.
000719 Mobiis Co.
00071A Finedigital
00071B Position Technology
00071C AT&T Fixed Wireless Services
00071D Satelsa Sistemas Y Aplicaciones De Telecomunicaciones
00071E Tri-M Engineering / Nupak Dev.
00071F European Systems Integration
000720 Trutzschler GmbH & Co. KG
000721 Formac Elektronik GmbH
000722 Nielsen Media Research
000723 Elcon Systemtechnik Gmbh
000724 Telemax Co.
000725 Bematech International
000727 Zi (HK)
000728 Neo Telecom
000729 Kistler Instrumente AG
00072A Innovance Networks
00072B Jung Myung Telecom Co.
00072C Fabricom
00072D CNSystems
00072E North Node AB
00072F Intransa
000730 Hutchison Optel Telecom Technology Co.
000731 Spiricon
000732 Aaeon Technology
000733 Dancontrol Engineering
000734 ONStor
000735 Flarion Technologies
000736 Data Video Technologies Co.
000737 Soriya Co.
000738 Young Technology Co.
000739 Motion Media Technology
00073A Inventel Systemes
00073B Tenovis GmbH & Co KG
00073C Telecom Design
00073D Nanjing Postel Telecommunications Co.
00073E China Great-Wall Computer Shenzhen Co.
00073F Woojyun Systec Co.
000740 Melco
000741 Sierra Automated Systems
000742 Current Technologies
000743 Chelsio Communications
000744 Unico
000745 Radlan Computer Communications
000746 Interlink BT
000747 Mecalc
000748 The Imaging Source Europe
000749 CENiX
00074A Carl Valentin GmbH
00074B Daihen
00074C Beicom
00074D Zebra Technologies
00074E Naughty boy co.
00074F Cisco Systems
000750 Cisco Systems
000751 m.u.t. - GmbH
000752 Rhythm Watch Co.
000753 Beijing Qxcomm Technology Co.
000754 Xyterra Computing
000755 Lafon SA
000756 Juyoung Telecom
000757 Topcall International AG
000758 Dragonwave
000759 Boris Manufacturing
00075A Air Products and Chemicals
00075B Gibson Guitars
00075C Eastman Kodak Company
00075D Celleritas
00075E Pulsar Technologies
00075F VCS Video Communication Systems AG
000760 Tomis Information & Telecom
000761 Logitech SA
000762 Group Sense Limited
000763 Sunniwell Cyber Tech. Co.
000764 YoungWoo Telecom Co.
000765 Jade Quantum Technologies
000766 Chou Chin Industrial Co.
000767 Yuxing Electronics Company Limited
000768 Danfoss A/S
000769 Italiana Macchi SpA
00076A Nexteye Co.
00076B Stralfors AB
00076C Daehanet
00076D Flexlight Networks
00076E Sinetica Limited
00076F Synoptics Limited
000770 Locusnetworks
000771 Embedded System
000772 Alcatel Shanghai Bell Co.
000773 Ascom Powerline Communications
000774 GuangZhou Thinker Technology Co.
000775 Valence Semiconductor
000776 Federal APD
000777 Motah
000778 Gerstel Gmbh & Co. KG
000779 Sungil Telecom Co.
00077A Infoware System Co.
00077B Millimetrix Broadband Networks
00077C OnTime Networks
00077E Elrest GmbH
00077F J Communications Co.
000780 Bluegiga Technologies OY
000781 Itron
000782 Nauticus Networks
000783 SynCom Network
000784 Cisco Systems
000785 Cisco Systems
000786 Wireless Networks
000787 Idea System Co.
000788 Clipcomm
000789 Eastel Systems
00078A Mentor Data System
00078B Wegener Communications
00078C Elektronikspecialisten i Borlange AB
00078D NetEngines
00078E Garz & Friche GmbH
00078F Emkay Innovative Products
000790 Tri-M Technologies (s) Limited
000791 International Data Communications
000792 Suetron Electronic GmbH
000793 Shin Satellite Public Company Limited
000794 Simple Devices
000795 Elitegroup Computer System Co. (ECS)
000796 LSI Systems
000797 Netpower Co.
000798 Selea SRL
000799 Tipping Point Technologies
00079A SmartSight Networks
00079B Aurora Networks
00079C Golden Electronics Technology Co.
00079D Musashi Co.
00079E Ilinx Co.
00079F Action Digital
0007A0 e-Watch
0007A1 Viasys Healthcare Gmbh
0007A2 Opteon
0007A3 Ositis Software
0007A4 GN Netcom
0007A5 Y.D.K Co.
0007A6 Home Automation
0007A7 A-Z
0007A8 Haier Group Technologies
0007A9 Novasonics
0007AA Quantum Data
0007AC Eolring
0007AD Pentacon GmbH Foto-und Feinwerktechnik
0007AE Britestream Networks
0007AF N-Tron
0007B0 Office Details
0007B1 Equator Technologies
0007B2 Transaccess S.A.
0007B3 Cisco Systems
0007B4 Cisco Systems
0007B5 Any One Wireless
0007B6 Telecom Technology
0007B7 Samurai Ind. Prods Eletronicos Ltda
0007B8 American Predator
0007B9 Ginganet
0007BA UTStarcom
0007BB Candera
0007BC Identix
0007BD Radionet
0007BE DataLogic SpA
0007BF Armillaire Technologies
0007C0 NetZerver
0007C1 Overture Networks
0007C2 Netsys Telecom
0007C3 Cirpack
0007C4 Jean Co.
0007C5 Gcom
0007C6 VDS Vosskuhler GmbH
0007C7 Synectics Systems Limited
0007C8 Brain21
0007C9 Technol Seven Co.
0007CA Creatix Polymedia Ges Fur Kommunikaitonssysteme
0007CB Freebox SA
0007CC Kaba Benzing GmbH
0007CD Nmtel Co.
0007CE Cabletime Limited
0007CF Anoto AB
0007D0 Automat Engenharia de Automaoa Ltda.
0007D1 Spectrum Signal Processing
0007D2 Logopak Systeme
0007D3 Stork Digital Imaging B.V.
0007D4 Zhejiang Yutong Network Communication Co
0007D5 3e Technologies Int;.
0007D6 Commil
0007D7 Caporis Networks AG
0007D8 Hitron Systems
0007D9 Splicecom
0007DA Neuro Telecom Co.
0007DB Kirana Networks
0007DC Atek Co
0007DD Cradle Technologies
0007DE eCopilt AB
0007DF Vbrick Systems
0007E0 Palm
0007E1 WIS Communications Co.
0007E2 Bitworks
0007E3 Navcom Technology
0007E4 SoftRadio Co.
0007E5 Coup
0007E6 edgeflow Canada
0007E7 FreeWave Technologies
0007E8 St. Bernard Software
0007E9 Intel
0007EA Massana
0007EB Cisco Systems
0007EC Cisco Systems
0007ED Altera
0007EE telco Informationssysteme GmbH
0007EF Lockheed Martin Tactical Systems
0007F0 LogiSync
0007F1 TeraBurst Networks
0007F2 IOA
0007F3 Think Engine Networks
0007F4 Eletex Co.
0007F5 Bridgeco Co AG
0007F6 Qqest Software Systems
0007F7 Galtronics
0007F8 ITDevices
0007F9 Phonetics
0007FA ITT Co.
0007FB Giga Stream Umts Technologies Gmbh
0007FC Adept Systems
0007FD LANergy
0007FE Rigaku
0007FF Gluon Networks
000800 Multitech Systems
000801 HighSpeed Surfing
000802 Compaq Computer
000803 Cos Tron
000804 ICA
000805 Techno-Holon
000806 Raonet Systems
000807 Access Devices Limited
000808 PPT Vision
000809 Systemonic AG
00080A Espera-Werke GmbH
00080B Birka BPA Informationssystem AB
00080C VDA elettronica SrL
00080D Toshiba
00080E Motorola
00080F Proximion Fiber Optics AB
000810 Key Technology
000811 Voix
000812 GM-2
000813 Diskbank
000814 TIL Technologies
000815 Cats Co.
000816 Bluetags A/S
000817 EmergeCore Networks
000818 Pixelworks
000819 Banksys
00081A Sanrad Intelligence Storage Communications (2000)
00081B Windigo Systems
00081C @pos.com
00081D Ipsil, Incorporated
00081E Repeatit AB
00081F Pou Yuen Tech
000820 Cisco Systems
000821 Cisco Systems
000822 InPro Comm
000823 Texa
000824 Promatek Industries
000825 Acme Packet
000826 Colorado Med Tech
000827 Pirelli Broadband Solutions
000828 Koei Engineering
000829 Aval Nagasaki
00082A Powerwallz Network Security
00082B Wooksung Electronics
00082C Homag AG
00082D Indus Teqsite Private Limited
00082E Multitone Electronics PLC
00084E DivergeNet
00084F Qualstar
000850 Arizona Instrument
000851 Canadian Bank Note Company
000852 Davolink Co.
000853 Schleicher GmbH & Co. Relaiswerke KG
000854 Netronix
000855 Nasa-goddard Space Flight Center
000856 Gamatronic Electronic Industries
000857 Polaris Networks
000858 Novatechnology
000859 ShenZhen Unitone Electronics Co.
00085A IntiGate
00085B Hanbit Electronics Co.
00085C Shanghai Dare Technologies Co.
00085D Aastra
00085E PCO AG
00085F Picanol N.V.
000860 LodgeNet Entertainment
000861 SoftEnergy Co.
000862 NEC Eluminant Technologies
000863 Entrisphere
000864 Fasy S.p.A.
000865 Jascom CO.
000866 DSX Access Systems
000867 Uptime Devices
000868 PurOptix
000869 Command-e Technology Co.
00086A Industrie Technik IPS GmbH
00086B Mipsys
00086C Plasmon LMS
00086D Missouri FreeNet
00086E Hyglo AB
00086F Resources Computer Network
000870 Rasvia Systems
000871 Northdata Co.
000872 Sorenson Technologies
000873 DAP Design B.V.
000874 Dell Computer
000875 Acorp Electronics
000876 SDSystem
000877 Liebert Hiross S.p.a.
000878 Benchmark Storage Innovations
000879 CEM
00087A Wipotec GmbH
00087B RTX Telecom A/S
00087C Cisco Systems
00087D Cisco Systems
00087E Bon Electro-Telecom
00087F Spaun Electronic Gmbh & Co. KG
000880 BroadTel Canada Communications
000881 Digital Hands Co.
000882 Sigma
000883 Hewlett-Packard Company
000884 Index Braille AB
000885 EMS Dr. Thomas Wuensche
000886 Hansung Teliann
000887 Maschinenfabrik Reinhausen GmbH
000888 Oullim Information Technology
000889 Echostar Technologies
00088A Minds@Work
00088B Tropic Networks
00088C Quanta Network Systems
00088D Sigma-Links
00088E Nihon Computer Co.
00088F Advanced Digital Technology
000890 Avilinks SA
000891 Lyan
000892 EM Solutions
000893 LE Information Communication
000894 InnoVISION Multimedia
000895 Dirc Technologie Gmbh &KG
000896 Printronix
000897 Quake Technologies
000898 Gigabit Optics
000899 Netbind
00089A Alcatel Microelectronics
00089B ICP Electronics
00089C Elecs Industry Co.
00089D UHD-Elektronik
00089E Beijing Enter-NetLTD
00089F EFM Networks
0008A0 Stotz Feinmesstechnik GmbH
0008A1 CNet Technology
0008A2 ADI Engineering
0008A3 Cisco Systems
0008A4 Cisco Systems
0008A5 Peninsula Systems
0008A6 Multiware & Image Co.
0008A7 iLogic
0008A8 Systec Co.
0008A9 SangSang Technology
0008AA Karam
0008AB EnerLinx.com
0008AC Private
0008AD Toyo-Linx Co.
0008AE PacketFront Sweden AB
0008AF Novatec
0008B0 BKtel communications GmbH
0008B1 ProQuent Systems
0008B2 Shenzhen Compass Technology Development Co.
0008B3 Fastwel
0008B4 Syspol
0008B5 TAI Guen Enterprise CO.
0008B6 RouteFree
0008B7 HIT Incorporated
0008B8 E.F. Johnson
0008B9 Kaon Media Co.
0008BA Erskine Systems
0008BB NetExcell
0008BC Ilevo AB
0008BD Tepg-us
0008BE Xenpak MSA Group
0008BF Aptus Elektronik AB
0008C0 ASA Systems
0008C1 Avistar Communications
0008C2 Cisco Systems
0008C3 Contex A/S
0008C4 Hikari Co.
0008C5 Liontech Co.
0008C6 Philips Consumer Communications
0008C7 Compaq Computer
0008C8 Soneticom
0008C9 TechniSat Digital GmbH
0008CA TwinHan Technology Co.
0008CB Zeta Broadband
0008CC Remotec
0008CD With-Net
0008CE IPMobileNet
0008CF Nippon Koei Power Systems Co.
0008D0 Musashi Engineering Co.
0008D1 Karel
0008D2 Zoom Networks
0008D3 Hercules Technologies S.A.
0008D4 IneoQuest Technologies
0008D5 Vanguard Managed Solutions
0008D6 Hassnet
0008D7 HOW
0008D8 Dowkey Microwave
0008D9 Mitadenshi Co.
0008DA SofaWare Technologies
0008DB Corrigent Systems
0008DC Wiznet
0008DD Telena Communications
0008DE 3UP Systems
0008DF Alistel
0008E0 ATO Technology
0008E1 Barix AG
0008E2 Cisco Systems
0008E3 Cisco Systems
0008E4 Envenergy
0008E5 IDK
0008E6 Littlefeet
0008E7 SHI ControlSystems
0008E8 Excel Master
0008E9 NextGig
0008EA Motion Control Engineering
0008EB Romwin Co.
0008EC Zonu
0008ED ST&T Instrument
0008EE Logic Product Development
0008EF Dibal
0008F0 Next Generation Systems
0008F1 Voltaire
0008F2 C&S Technology
0008F3 Wany
0008F4 Bluetake Technology Co.
0008F5 Yestechnology Co.
0008F6 Sumitomo Electric Hightechs.co.
0008F7 Hitachi, Semiconductor &amp; Integrated Circuits Gr
0008F8 Guardall
0008F9 Padcom
0008FA Karl E.Brinkmann GmbH
0008FB SonoSite
0008FC Gigaphoton
0008FD BlueKorea Co.
0008FE Unik C&C Co.
0008FF Trilogy Broadcast (Holdings)
000900 TMT
000901 Shenzhen Shixuntong Information & Technoligy Co
000902 Redline Communications
000903 Panasas
000904 Mondial Electronic
000905 iTEC Technologies
000906 Esteem Networks
000907 Chrysalis Development
000908 VTech Technology
000909 Telenor Connect A/S
00090A SnedFar Technology Co.
00090B MTL  Instruments PLC
00090C Mayekawa Mfg. Co.
00090D Leader Electronics
00090E Helix Technology
00090F Fortinet
000910 Simple Access
000911 Cisco Systems
000912 Cisco Systems
000913 SystemK
000914 Computrols
000915 CAS
000916 Listman Home Technologies
000917 WEM Technology
000918 Samsung Techwin Co.
000919 MDS Gateways
00091A Macat Optics & Electronics Co.
00091B Digital Generation
00091C CacheVision
00091D Proteam Computer
00091E Firstech Technology
00091F A&amp;D Co.
000920 Epox Computer Co.
000921 Planmeca Oy
000922 Touchless Sensor Technology AG
000923 Heaman System Co.
000924 Telebau GmbH
000925 VSN Systemen BV
000926 Yoda Communications
000927 Toyokeiki Co.
000928 Telecore
000929 Sanyo Industries (UK) Limited
00092A Mytecs Co.
00092B iQstor Networks
00092C Hitpoint
00092D High Tech Computer
00092E B&Tech System
00092F Akom Technology
000930 AeroConcierge
000931 Future Internet
000932 Omnilux
000933 Optovalley Co.
000934 Dream-Multimedia-Tv GmbH
000935 Sandvine Incorporated
000936 Ipetronik GmbH &KG
000937 Inventec Appliance
000938 Allot Communications
000939 ShibaSoku Co.
00093A Molex Fiber Optics
00093B Hyundai Networks
00093C Jacques Technologies P/L
00093D Newisys
00093E C&I Technologies
00093F Double-Win Enterpirse CO.
000940 Agfeo Gmbh & Co. KG
000941 Allied Telesis K.K.
000942 Cresco
000943 Cisco Systems
000944 Cisco Systems
000945 Palmmicro Communications
000946 Cluster Labs GmbH
000947 Aztek
000948 Vista Control Systems
000949 Glyph Technologies
00094A Homenet Communications
00094B FillFactory NV
00094C Communication Weaver Co.
00094D Braintree Communications
00094E Bartech Systems International
00094F elmegt GmbH & Co. KG
000950 Independent Storage
000951 Apogee Instruments
000952 Auerswald GmbH & Co. KG
000953 Linkage System IntegrationLtd.
000954 AMiT spol. s. r. o.
000955 Young Generation International
000956 Network Systems Group, (NSG)
000957 Supercaller
000958 Intelnet S.A.
000959 Sitecsoft
00095A Racewood Technology
00095B Netgear
00095C Philips Medical Systems - Cardiac and Monitoring Systems (CM
00095D Dialogue Technology
00095E Masstech Group
00095F Telebyte
000960 Yozan
000961 Switchgear and Instrumentation
000962 Filetrac AS
000963 Dominion Lasercom
000964 Hi-Techniques
000965 Private
000966 Thales Navigation
000967 Tachyon
000968 Technoventure
000969 Meret Optical Communications
00096A Cloverleaf Communications
00096B IBM
00096C Imedia Semiconductor
00096D Powernet Technologies
00096E Giant Electronics
00096F Beijing Zhongqing Elegant Tech.,Limited
000970 Vibration Research
000971 Time Management
000972 Securebase
000973 Lenten Technology Co.
000974 Innopia Technologies
000975 fSONA Communications
000976 Datasoft Isdn Systems Gmbh
000977 Brunner Elektronik AG
000978 Aiji System Co.
000979 Advanced Television Systems Committee
00097A Louis Design Labs.
00097B Cisco Systems
00097C Cisco Systems
00097D SecWell Networks Oy
00097E IMI Technology CO.
00097F Vsecure 2000
000980 Power Zenith
000981 Newport Networks
000982 Loewe Opta GmbH
000983 Gvision Incorporated
000984 MyCasa Network
000985 Auto Telecom Company
000986 Metalink
000987 Nishi Nippon Electric Wire & Cable Co.
000988 Nudian Electron Co.
000989 VividLogic
00098A EqualLogic
00098B Entropic Communications
00098C Option Wireless Sweden
00098D DCT (Digital Communication Technologies)
00098E ipcas GmbH
00098F Cetacean Networks
000990 Acksys Communications & Systems
000991 GE Fanuc Automation Manufacturing
000992 InterEpoch Technology
000993 Visteon
000994 Cronyx Engineering
000995 Castle Technology
000996 RDI
000997 Nortel Networks
000998 Capinfo Company Limited
000999 CP Georges Renault
00099A Elmo Company, Limited
00099B Western Telematic
00099C Naval Research Laboratory
00099D Haliplex Communications
00099E Testech
00099F Videx
0009A0 Microtechno
0009A1 Telewise Communications
0009A2 Interface Co.
0009A3 Leadfly Techologies
0009A4 Hartec
0009A5 Hansung Eletronic Industries Development CO.
0009A6 Ignis Optics
0009A7 Bang & Olufsen A/S
0009A8 Eastmode Pte
0009A9 Ikanos Communications
0009AA Data Comm for Business
0009AB Netcontrol Oy
0009AC Lanvoice
0009AD Hyundai Syscomm
0009AE Okano Electric Co.
0009AF e-generis
0009B0 Onkyo
0009B1 Kanematsu Electronics
0009B2 L&F
0009B3 MCM Systems
0009B4 Kisan Telecom CO.
0009B5 3J Tech. Co.
0009B6 Cisco Systems
0009B7 Cisco Systems
0009B8 Entise Systems
0009B9 Action Imaging Solutions
0009BA Maku Informationstechik Gmbh
0009BB MathStar
0009BC Integrian
0009BD Epygi Technologies
0009BE Mamiya-OP Co.
0009BF Nintendo Co.
0009C0 6wind
0009C1 Proces-data A/S
0009C2 Private
0009C3 Netas
0009C4 Medicore Co.
0009C5 Kingene Technology
0009C6 Visionics
0009C7 Movistec
0009C8 Sinagawa Tsushin Keisou Service
0009C9 BlueWINC Co.
0009CA iMaxNetworks(Shenzhen)Limited.
0009CB HBrain
0009CC Moog GmbH
0009CD Hudson Soft Co.
0009CE SpaceBridge Semiconductor
0009CF iAd GmbH
0009D0 Versatel Networks
0009D1 Seranoa Networks
0009D2 Mai Logic
0009D3 Western DataCom Co.
0009D4 Transtech Networks
0009D5 Signal Communication
0009D6 KNC One GmbH
0009D7 DC Security Products
0009D8 Private
0009D9 Neoscale Systems
0009DA Control Module
0009DB eSpace
0009DC Galaxis Technology AG
0009DD Mavin Technology
0009DE Samjin Information & Communications Co.
0009DF Vestel Komunikasyon Sanayi ve Ticaret A.S.
0009E0 Xemics S.A.
0009E1 Gemtek Technology Co.
0009E2 Sinbon Electronics Co.
0009E3 Angel Iglesias S.A.
0009E4 K Tech Infosystem
0009E5 Hottinger Baldwin Messtechnik GmbH
0009E6 Cyber Switching
0009E7 ADC Techonology
0009E8 Cisco Systems
0009E9 Cisco Systems
0009EA YEM
0009EB HuMANDATA
0009EC Daktronics
0009ED CipherOptics
0009EE Meikyo Electric Co.
0009EF Vocera Communications
0009F0 Shimizu Technology
0009F1 Yamaki Electric
0009F2 Cohu,, Electronics Division
0009F3 Well Communication
0009F4 Alcon Laboratories
0009F5 Emerson Network Power Co.
0009F6 Shenzhen Eastern Digital Tech
0009F7 SED, a division of Calian
0009F8 Unimo Technology CO.
0009F9 ART Japan CO.
0009FB Philips Medizinsysteme Boeblingen GmbH
0009FC Ipflex
0009FD Ubinetics Limited
0009FE Daisy Technologies
0009FF X.net 2000 GmbH
000A00 Mediatek
000A01 Sohoware
000A02 Annso CO.
000A03 Endesa Servicios
000A04 3Com Europe
000A05 Widax
000A06 Teledex
000A07 WebWayOne
000A08 Alpine Electronics
000A09 TaraCom Integrated Products
000A0A Sunix Co.
000A0B Sealevel Systems
000A0C Scientific Research
000A0D MergeOptics GmbH
000A0E Invivo Research
000A0F Ilryung Telesys
000A10 Fast Media Integrations AG
000A11 ExPet Technologies
000A12 Azylex Technology
000A13 Silent Witness
000A14 Teco a.s.
000A15 Silicon Data
000A16 Lassen Research
000A17 Nestar Communications
000A18 Vichel
000A19 Valere Power
000A1A Imerge
000A1B Stream Labs
000A1C Bridge Information Co.
000A1D Optical Communications Products
000A1E Red-M Products Limited
000A1F ART Ware Telecommunication Co.
000A20 SVA Networks
000A21 Integra Telecom Co.
000A22 Amperion
000A23 Parama Networks
000A24 Octave Communications
000A25 Ceragon Networks
000A26 Ceia S.p.a.
000A27 Apple Computer
000A28 Motorola
000A29 Pan Dacom Networking AG
000A2A QSI Systems
000A2B Etherstuff
000A2C Active Tchnology
000A2D Private
000A2E Maple Networks CO.
000A2F Artnix
000A30 Johnson Controls-ASG
000A31 HCV Wireless
000A32 Xsido
000A33 Sierra Logic
000A34 Identicard Systems Incorporated
000A35 Xilinx
000A36 Synelec Telecom Multimedia
000A37 Procera Networks
000A38 Netlock Technologies
000A39 LoPA Information Technology
000A3A J-three International Holding Co.
000A3B GCT Semiconductor
000A3C Enerpoint
000A3D Elo Sistemas Eletronicos S.A.
000A3E Eads Telecom
000A3F Data East
000A40 Crown Audio
000A41 Cisco Systems
000A42 Cisco Systems
000A43 Chunghwa Telecom Co.
000A44 Avery Dennison Deutschland GmbH
000A45 Audio-Technica
000A46 ARO Controls SAS
000A47 Allied Vision Technologies
000A48 Albatron Technology
000A49 Acopia Networks
000A4A Targa Systems
000A4B DataPower Technology
000A4C Molecular Devices
000A4D Noritz
000A4E Unitek Electronics
000A4F Brain Boxes Limited
000A50 Remotek
000A51 GyroSignal Technology Co.
000A52 AsiaRF
000A53 Intronics, Incorporated
000A54 Laguna Hills
000A55 Markem
000A56 Hitachi Maxell
000A57 Hewlett-Packard Company - Standards
000A58 Ingenieur-Buero Freyer & Siegel
000A59 HW server
000A5A GreenNET Technologies Co.
000A5B Power-One as
000A5C Carel s.p.a.
000A5D PUC Founder (MSC) Berhad
000A5E 3COM
000A5F almedio
000A60 Autostar Technology Pte
000A61 Cellinx Systems
000A62 Crinis Networks
000A63 DHD GmbH
000A64 Eracom Technologies
000A65 GentechMedia.co.
000A66 Mitsubishi Electric System & Service Co.
000A67 OngCorp
000A68 SolarFlare Communications
000A69 Sunny Bell Technology Co.
000A6A SVM Microwaves s.r.o.
000A6B Tadiran Telecom Business Systems
000A6C Walchem
000A6D EKS Elektronikservice GmbH
000A6E Broadcast Technology Limited
000A6F ZyFLEX Technologies
000A70 Mpls Forum
000A71 Avrio Technologies
000A72 SimpleTech
000A73 Scientific Atlanta
000A74 Manticom Networks
000A75 Cat Electronics
000A76 Beida Jade Bird Huaguang Technology Co.
000A77 Bluewire Technologies
000A78 Olitec
000A79 corega K.K.
000A7A Kyoritsu Electric Co.
000A7B Cornelius Consult
000A7C Tecton
000A7D Valo
000A7E The Advantage Group
000A7F Teradon Industries
000A80 Telkonet
000A81 Teima Audiotex S.L.
000A82 Tatsuta System Electronics Co.
000A83 Salto Systems S.L.
000A84 Rainsun Enterprise Co.
000A85 Plat'c2
000A86 Lenze
000A87 Integrated Micromachines
000A88 InCypher S.A.
000A89 Creval Systems
000A8A Cisco Systems
000A8B Cisco Systems
000A8C Guardware Systems
000A8D Eurotherm Limited
000A8E Invacom
000A8F Aska International
000A90 Bayside Interactive
000A91 HemoCue AB
000A92 Presonus
000A93 W2 Networks
000A94 ShangHai cellink CO.
000A95 Apple Computer
000A96 Mewtel Technology
000A97 Sonicblue
000A98 M+F Gwinner GmbH & Co
000A99 Dataradio
000A9A Aiptek International
000A9B Towa Meccs
000A9C Server Technology
000A9D King Young Technology Co.
000A9E BroadWeb Corportation
000A9F Pannaway Technologies
000AA0 Cedar Point Communications
000AA1 V V S Limited
000AA2 Systek
000AA3 Shimafuji Electric Co.
000AA4 Shanghai Surveillance Technology Co
000AA5 Maxlink Industries Limited
000AA6 Hochiki
000AA7 FEI Company
000AA8 ePipe
000AA9 Brooks Automation GmbH
000AAA AltiGen Communications
000AAB Toyota MACS
000AAC TerraTec Electronic GmbH
000AAD Stargames
000AAE Rosemount Process Analytical
000AAF Pipal Systems
000AB0 Loytec Electronics Gmbh
000AB1 Genetec
000AB2 Fresnel Wireless Systems
000AB3 Fa. Gira
000AB4 Etic Telecommunications
000AB5 Digital Electronic Network
000AB6 Compunetix
000AB7 Cisco Systems
000AB8 Cisco Systems
000AB9 Astera Technologies
000ABA Arcon Technology Limited
000ABB Taiwan Secom Co
000ABC Seabridge
000ABD Rupprecht & Patashnick Co.
000ABE Opnet Technologies CO.
000ABF Hirota SS
000AC0 Fuyoh Video Industry CO.
000AC1 Futuretel
000AC2 FiberHome Telecommunication Technologies CO.
000AC3 eM Technics Co.
000AC4 Daewoo Teletech Co.
000AC5 Color Kinetics
000AC6 Ceterus Networks
000AC7 Unication Group
000AC8 Zpsys Co.,ltd. (planning&management)
000AC9 Zambeel
000ACA Yokoyama Shokai Co.
000ACB Xpak MSA Group
000ACC Winnow Networks
000ACD Sunrich Technology Limited
000ACE Radiantech
000ACF Provideo Multimedia Co.
000AD0 Niigata Develoment Center,  F.I.T. Co.
000AD1 MWS
000AD2 Jepico
000AD3 Initech Co.
000AD4 CoreBell Systems
000AD5 Brainchild Electronic Co.
000AD6 BeamReach Networks
000AD7 Origin Electric Co.
000AD8 IPCserv Technology
000AD9 Sony Ericsson Mobile Communications AB
000ADA Private
000ADB SkyPilot Network
000ADC RuggedCom
000ADD InSciTek Microsystems
000ADE Happy Communication Co.
000ADF Gennum
000AE0 Fujitsu Softek
000AE1 EG Technology
000AE2 Binatone Electronics International
000AE3 Yang MEI Technology CO.
000AE4 Wistron
000AE5 ScottCare
000AE6 Elitegroup Computer System Co. (ECS)
000AE7 Eliop S.A.
000AE8 Cathay Roxus Information Technology Co.
000AE9 AirVast Technology
000AEA Adam Elektroniksti.
000AEB Shenzhen Tp-Link Technology Co;
000AEC Koatsu Gas Kogyo Co.
000AED Harting Vending G.m.b.h. & CO KG
000AEE GCD Hard- & Software GmbH
000AEF Otrum ASA
000AF0 Shin-oh Electronics CO., R&D
000AF1 Clarity Design
000AF2 NeoAxiom
000AF3 Cisco Systems
000AF4 Cisco Systems
000AF5 Airgo Networks
000AF6 Computer Process Controls
000AF7 Broadcom
000AF8 American Telecare
000AF9 HiConnect
000AFA Traverse Technologies Australia
000AFB Ambri Limited
000AFC Core Tec Communications
000AFD Viking Electronic Services
000AFE NovaPal
000AFF Kilchherr Elektronik AG
000B00 Fujian Start Computer Equipment Co.
000B01 Daiichi Electronics CO.
000B02 Dallmeier electronic
000B03 Taekwang Industrial Co.
000B04 Volktek
000B05 Pacific Broadband Networks
000B06 Motorola BCS
000B07 Voxpath Networks
000B08 Pillar Data Systems
000B09 Ifoundry Systems Singapore
000B0A dBm Optics
000B0B Corrent
000B0C Agile Systems
000B0D Air2U
000B0E Trapeze Networks
000B0F Nyquist Industrial Control BV
000B10 11wave Technonlogy Co.
000B11 Himeji ABC Trading Co.
000B12 Nuri Telecom Co.
000B13 Zetron
000B14 ViewSonic
000B15 Platypus Technology
000B16 Communication Machinery
000B17 MKS Instruments
000B18 Private
000B19 Vernier Networks
000B1A Teltone
000B1B Systronix
000B1C Sibco bv
000B1D LayerZero Power Systems
000B1E Kappa Opto-electronics Gmbh
000B1F I CON Computer Co.
000B20 Hirata
000B21 G-Star Communications
000B22 Environmental Systems and Services
000B23 Siemens Subscriber Networks
000B24 AirLogic
000B25 Aeluros
000B26 Wetek
000B27 Scion
000B28 Quatech
000B29 LG Industrial Systems Co.
000B2A Howtel Co.
000B2B Hostnet
000B2C Eiki Industrial Co.
000B2D Danfoss
000B2E Cal-Comp Electronics (Thailand) Public Company Limited Taipe
000B2F bplan GmbH
000B30 Beijing Gongye Science & Technology Co.
000B31 Yantai ZhiYang Scientific and technology industry CO.
000B32 Vormetric
000B33 Vivato
000B34 ShangHai Broadband TechnologiesLTD
000B35 Quad Bit System co.
000B36 Productivity Systems
000B37 Manufacture DES Montres Rolex SA
000B38 Knuerr AG
000B39 Keisoku Giken Co.
000B3A Fortel DTV
000B3B devolo AG
000B3C Cygnal Integrated Products
000B3D Contal OK
000B3E BittWare
000B3F Anthology Solutions
000B40 OpNext
000B41 Ing. Buero Dr. Beutlhauser
000B42 commax Co.
000B43 Microscan Systems
000B44 Concord IDea
000B45 Cisco
000B46 Cisco
000B47 Advanced Energy
000B48 sofrel
000B49 RF-Link System
000B4A Visimetrics (UK)
000B4B Visiowave SA
000B4C Clarion (M) Sdn Bhd
000B4D Emuzed
000B4E VertexRSI Antenna Products Division
000B4F Verifone
000B50 Oxygnet
000B51 Micetek International
000B52 Joymax Electronics
000B53 Initium Co.
000B54 BiTMICRO Networks
000B55 ADInstruments
000B56 Cybernetics
000B57 Silicon Laboratories
000B58 Astronautics C.A 
000B59 ScriptPro
000B5A HyperEdge
000B5B Rincon Research
000B5C Newtech Co.
000B5D Fujitsu Limited
000B5E Audio Engineering Society
000B5F Cisco Systems
000B60 Cisco Systems
000B61 Friedrich Ltze GmbH &Co.
000B62 Ingenieurbro Ingo Mohnen
000B63 Kaleidescape
000B64 Kieback & Peter GmbH & Co KG
000B65 Sy.A.C. srl
000B66 Teralink Communications
000B67 Topview Technology
000B68 Addvalue Communications Pte
000B69 Franke Finland Oy
000B6A Asiarock Incorporation
000B6B Wistron Neweb
000B6C Sychip
000B6D Solectron Japan Nakaniida
000B6E Neff Instrument
000B6F Media Streaming Networks
000B70 Load Technology
000B71 Litchfield Communications
000B72 Lawo AG
000B73 Kodeos Communications
000B74 Kingwave Technology Co.
000B75 Iosoft
000B76 ET&T Co.
000B77 Cogent Systems
000B78 Taifatech
000B79 X-COM
000B7A Wave Science
000B7B Test-Um
000B7C Telex Communications
000B7D Solomon Extreme International
000B7E Saginomiya Seisakusho
000B7F OmniWerks
000B80 Lycium Networks
000B81 Kaparel
000B82 Grandstream Networks
000B83 Datawatt B.V.
000B84 Bodet
000B85 Airespace
000B86 Aruba Networks
000B87 American Reliance
000B88 Vidisco
000B89 Top Global Technology
000B8A Miteq
000B8B Kerajet
000B8C flextronics israel
000B8D Avvio Networks
000B8E Ascent
000B8F Akita Electronics Systems Co.
000B90 Covaro Networks
000B91 Aglaia Gesellschaft fr Bildverarbeitung und Kommunikation
000B92 Ascom Danmark A/S
000B93 Barmag Electronic
000B94 Digital Monitoring Products
000B95 eBet Gaming Systems
000B96 Innotrac Diagnostics Oy
000B97 Matsushita Electric Industrial Co.
000B98 NiceTechVision
000B99 SensAble Technologies
000B9A Shanghai Ulink Telecom Equipment Co.
000B9B Sirius System Co
000B9C TriBeam Technologies
000B9D TwinMOS Technologies
000B9E Yasing Technology
000B9F Neue Elsa Gmbh
000BA0 T&L Information
000BA1 Syscom
000BA2 Sumitomo Electric Networks
000BA3 Siemens AG
000BA4 Shiron Satellite Communications (1996)
000BA5 Quasar Cipta Mandiri
000BA6 Miyakawa Electric Works
000BA7 Maranti Networks
000BA8 Hanback Electronics CO.
000BA9 CloudShield Technologies
000BAA Aiphone co.
000BAB Advantech Technology (china) Co.
000BAC 3Com Europe
000BAD PC-PoS
000BAE Vitals System
000BAF Wooju Communications Co
000BB0 Sysnet Telematica srl
000BB1 Super Star Technology Co.
000BB2 Smallbig Technology
000BB3 RiT technologies
000BB4 RDC Semiconductor,
000BB5 nStor Technologies
000BB6 Mototech
000BB7 Micro Systems Co.
000BB8 Kihoku Electronic Co.
000BB9 Imsys AB
000BBA Harmonic Broadband Access Networks
000BBB Etin Systems Co.
000BBC En Garde Systems
000BBD Connexionz Limited
000BBE Cisco Systems
000BBF Cisco Systems
000BC0 China Iwncomm Co.
000BC1 Bay Microsystems
000BC2 Corinex Communication
000BC3 Multiplex
000BC4 Biotronik Gmbh & Co
000BC5 SMC Networks
000BC6 ISAC
000BC7 Icet S.p.a.
000BC8 AirFlow Networks
000BC9 Electroline Equipment
000BCA Datavan International
000BCB Fagor Automation , S. Coop
000BCC Jusan
000BCD Compaq (HP)
000BCE Free2move AB
000BCF Agfa NDT
000BD0 XiMeta Technology Americas
000BD1 Aeronix
000BD2 Remopro Technology
000BD3 cd3o
000BD4 Beijing Wise Technology & Science DevelopmentLtd
000BD5 Nvergence
000BD6 Paxton Access
000BD7 MBB Gelma GmbH
000BD8 Industrial Scientific
000BD9 General Hydrogen
000BDA EyeCross Co.
000BDB Dell ESG Pcba Test
000BDC Akcp
000BDD Tohoku Ricoh Co.
000BDE Teldix Gmbh
000BDF Shenzhen RouterD Networks Limited
000BE0 SercoNet
000BE1 Nokia NET Product Operations
000BE2 Lumenera
000BE3 Key Stream Co.
000BE4 Hosiden
000BE5 Hims Korea Co.
000BE6 Datel Electronics
000BE7 Comflux Technology
000BE8 Aoip
000BE9 Actel
000BEA Zultys Technologies
000BEB Systegra AG
000BEC Nippon Electric Instrument
000BED ELM
000BEE inc.jet, Incorporated
000BEF Code
000BF0 MoTEX Products Co.
000BF1 LAP Laser Applikations
000BF2 Chih-Kan Technology Co.
000BF3 BAE Systems
000BF4 Private
000BF5 Shanghai Sibo Telecom Technology Co.
000BF6 Nitgen Co.
000BF7 Nidek Co.
000BF8 Infinera
000BF9 Gemstone communications
000BFA Exemys SRL
000BFB D-NET International
000BFC Cisco Systems
000BFD Cisco Systems
000BFE Castel Broadband Limited
000BFF Berkeley Camera Engineering
000C00 BEB Industrie-Elektronik AG
000C01 Abatron AG
000C02 ABB Oy
000C03 Hdmi Licensing
000C04 Tecnova
000C05 RPA Reserch Co.
000C06 Nixvue Systems  Pte
000C07 Iftest AG
000C08 Humex Technologies
000C09 Hitachi IE Systems Co.
000C0A Guangdong Province Electronic Technology Research Institute
000C0B Broadbus Technologies
000C0C Appro Technology
000C0D Communications & Power Industries / Satcom Division
000C0E XtremeSpectrum
000C0F Techno-One Co.
000C10 PNI
000C11 Nippon Dempa Co.
000C12 Micro-Optronic-Messtechnik GmbH
000C13 MediaQ
000C14 Diagnostic Instruments
000C15 CyberPower Systems
000C16 Concorde Microsystems
000C17 AJA Video Systems
000C18 Zenisu Keisoku
000C19 Telio Communications GmbH
000C1A Quest Technical Solutions
000C1B Oracom Co
000C1C MicroWeb Co.
000C1D Mettler & Fuchs AG
000C1E Global Cache
000C1F Glimmerglass Networks
000C20 Fi WIn
000C21 Faculty of Science and Technology, Keio University
000C22 Double D Electronics
000C23 Beijing Lanchuan Tech. Co.
000C24 Anator
000C25 Allied Telesyn Networks
000C26 Weintek Labs.
000C27 Sammy
000C28 Rifatron
000C29 VMware
000C2A Octtel Communication Co.
000C2B Elias Technology
000C2C Enwiser
000C2D FullWave Technology Co.
000C2E Openet information technology(shenzhen) Co.
000C2F SeorimTechnology Co.
000C30 Cisco
000C31 Cisco
000C32 Avionic Design Development GmbH
000C33 Compucase Enterprise Co.
000C34 Vixen Co.
000C35 KaVo Dental GmbH & Co. KG
000C36 Sharp Takaya Electronics Industry Co.
000C37 Geomation
000C38 TelcoBridges
000C39 Sentinel Wireless
000C3A Oxance
000C3B Orion Electric Co.
000C3C MediaChorus
000C3D Glsystech Co.
000C3E Crest Audio
000C3F Cogent Defence & Security Networks,
000C40 Altech Controls
000C41 The Linksys Group
000C42 Routerboard.com
000C43 Ralink Technology
000C44 Automated Interfaces
000C45 Animation Technologies
000C46 Allied Telesyn
000C47 SK Teletech(R&D Planning Team)
000C48 QoStek
000C49 Dangaard Telecom RTC Division A/S
000C4A Cygnus Microsystems Private Limited
000C4B Cheops Elektronik
000C4C Arcor AG&Co.
000C4D Acra Control
000C4E Winbest Technology CO
000C4F UDTech Japan
000C50 Seagate Technology
000C51 Scientific Technologies
000C52 Roll Systems
000C53 Private
000C54 Pedestal Networks
000C55 Microlink Communications
000C56 Megatel Computer (1986)
000C57 Mackie Engineering Services Belgium Bvba
000C58 M&S Systems
000C59 Indyme Electronics
000C5A IBSmm Industrieelektronik Multimedia
000C5B Hanwang Technology Co.
000C5C GTN Systems B.V.
000C5D Chic Technology (china)
000C5E Calypso Medical
000C5F Avtec
000C60 ACM Systems
000C61 AC Tech DBA Advanced Digital
000C62 ABB Automation Technology Products AB, Control
000C63 Zenith Electronics
000C64 X2 MSA Group
000C65 Sunin Telecom
000C66 Pronto Networks
000C67 OYO Electric Co.
000C68 Oasis Semiconductor
000C69 National Radio Astronomy Observatory
000C6A Mbari
000C6B Kurz Industrie-Elektronik GmbH
000C6C Elgato Systems
000C6D BOC Edwards
000C6E Asustek Computer
000C6F Amtek system co.
000C70 ACC GmbH
000C71 Wybron
000C72 Tempearl Industrial Co.
000C73 Telson Electronics CO.
000C74 Rivertec
000C75 Oriental integrated electronics.
000C76 Micro-star International CO.
000C77 Life Racing
000C78 In-Tech Electronics Limited
000C79 Extel Communications P/L
000C7A DaTARIUS Technologies GmbH
000C7B Alpha Project Co.
000C7C Internet Information Image
000C7D Teikoku Electric MFG. CO.
000C7E Tellium Incorporated
000C7F synertronixx GmbH
000C80 Opelcomm
000C81 Nulec Industries
000C82 Network Technologies
000C83 Logical Solutions
000C84 Eazix
000C85 Cisco Systems
000C86 Cisco Systems
000C87 ATI
000C88 Apache Micro Peripherals
000C89 AC Electric Vehicles
000C8A Bose
000C8B Connect Tech
000C8C Kodicom Co.
000C8D Matrix Vision Gmbh
000C8E Mentor Engineering
000C8F Nergal s.r.l.
000C90 Octasic
000C91 Riverhead Networks
000C92 WolfVision Gmbh
000C93 Xeline Co.
000C94 United Electronic Industries
000C95 PrimeNet
000C96 OQO
000C97 NV ADB TTV Technologies SA
000C98 Letek Communications
000C99 Hitel Link Co.
000C9A Hitech Electronics
000C9B EE Solutions
000C9C Chongho information & communications
000C9D AirWalk Communications
000C9E MemoryLink
000C9F NKE
000CA0 StorCase Technology
000CA1 Sigmacom Co.
000CA2 Scopus Network Technologies
000CA3 Rancho Technology
000CA4 Prompttec Product Management GmbH
000CA5 Naman NZ
000CA6 Mintera
000CA7 Metro (Suzhou) Technologies Co.
000CA8 Garuda Networks
000CA9 Ebtron
000CAA Cubic Transportation Systems
000CAB Commend International
000CAC Citizen Watch Co.
000CAD BTU International
000CAE Ailocom Oy
000CAF TRI Term Co.
000CB0 Star Semiconductor
000CB1 Salland Engineering (Europe) BV
000CB2 safei Co.
000CB3 Round Co.
000CB4 AutoCell Laboratories
000CB5 Premier Technolgies
000CB6 Nanjing SEU Mobile & Internet Technology Co.
000CB7 Nanjing Huazhuo Electronics Co.
000CB8 Medion AG
000CB9 LEA
000CBA Jamex
000CBB Iskraemeco
000CBC Iscutum
000CBD Interface Masters
000CBE Private
000CBF Holy Stone Ent. Co.
000CC0 Genera Oy
000CC1 Cooper Industries
000CC2 Private
000CC3 BeWAN systems
000CC4 Tiptel AG
000CC5 Nextlink Co.
000CC6 Ka-Ro electronics GmbH
000CC7 Intelligent Computer Solutions
000CC8 Xytronix Research & Design
000CC9 Ilwoo Data & Technology Co.
000CCA Hitachi Global Storage Technologies
000CCB Design Combus
000CCC Aeroscout
000CCD IEC - Tc57
000CCE Cisco Systems
000CCF Cisco Systems
000CD0 Symetrix
000CD1 Sfom Technology
000CD2 Schaffner EMV AG
000CD3 Prettl Elektronik Radeberg GmbH
000CD4 Positron Public Safety Systems
000CD5 Passave
000CD6 Partner Tech
000CD7 Nallatech
000CD8 M. K. Juchheim GmbH & Co
000CD9 Itcare Co.
000CDA FreeHand Systems
000CDB Foundry Networks
000CDC Becs Technology
000CDD AOS Technologies AG
000CDE ABB Stotz-kontakt Gmbh
000CDF Pulnix America
000CE0 Trek Diagnostics
000CE1 The Open Group
000CE2 Rolls-Royce
000CE3 Option International N.V.
000CE4 NeuroCom International
000CE5 Motorola BCS
000CE6 Meru Networks
000CE7 MediaTek
000CE8 GuangZhou AnJuBao Co.
000CE9 Bloomberg L.P.
000CEA aphona Kommunikationssysteme
000CEB Cnmp Networks
000CEC Spectracom
000CED Real Digital Media
000CEE jp-embedded
000CEF Open Networks Engineering
000CF0 M & N GmbH
000CF1 Intel
000CF2 Gamesa Elica
000CF3 Call Image SA
000CF4 Akatsuki Electric Mfg.co.
000CF5 InfoExpress
000CF6 Sitecom Europe BV
000CF7 Nortel Networks
000CF8 Nortel Networks
000CF9 ITT Flygt AB
000CFA Digital Systems
000CFB Korea Network Systems
000CFC S2io Technologies
000CFD Private
000CFE Grand Electronic Co.
000CFF Mro-tek Limited
000D00 Seaway Networks
000D01 P&E Microcomputer Systems
000D02 NEC Access Technica
000D03 Matrics
000D04 Foxboro Eckardt Development GmbH
000D05 cybernet manufacturing
000D06 Compulogic Limited
000D07 Calrec Audio
000D08 AboveCable
000D09 Yuehua(Zhuhai) Electronic CO.
000D0A Projectiondesign as
000D0B Buffalo
000D0C MDI Security Systems
000D0D ITSupported
000D0E Inqnet Systems
000D0F Finlux
000D10 Embedtronics Oy
000D11 Dentsply - Gendex
000D12 Axell
000D13 Wilhelm Rutenbeck GmbH&Co.
000D14 Vtech Innovation LP dba Advanced American Telephones
000D15 Voipac s.r.o.
000D16 UHS Systems
000D17 Turbo NetworksLtd
000D18 Sunitec Enterprise Co.
000D19 Robe Show Lighting
000D1A Mustek System
000D1B Kyoto Electronics Manufacturing Co.
000D1C I2E Telecom
000D1D High-tek Harness ENT. CO.
000D1E Control Techniques
000D1F AV Digital
000D20 Asahikasei Technosystem Co.
000D21 Wiscore
000D22 Unitronics
000D23 Smart Solution
000D24 Sentec E&E CO.
000D25 Sanden
000D26 Primagraphics Limited
000D27 Microplex Printware AG
000D28 Cisco
000D29 Cisco
000D2A Scanmatic AS
000D2B Racal Instruments
000D2C Patapsco Designs
000D2D NCT Deutschland GmbH
000D2E Matsushita Avionics Systems
000D2F AIN Comm.Tech.Co.
000D30 IceFyre Semiconductor
000D31 Compellent Technologies
000D32 DispenseSource
000D33 Prediwave
000D34 Shell International Exploration and Production
000D35 PAC International
000D36 Wu Han Routon Electronic Co.
000D37 Wiplug
000D38 Nissin
000D39 Network Electronics
000D3A Microsoft
000D3B Microelectronics Technology
000D3C i.Tech Dynamic
000D3D Hammerhead Systems
000D3E Aplux Communications
000D3F VXI Technology
000D40 Verint Loronix Video Solutions
000D41 Siemens AG ICM MP UC RD IT KLF1
000D42 Newbest Development Limited
000D43 DRS Tactical Systems
000D44 Private
000D45 Tottori Sanyo Electric Co.
000D46 SSD Drives
000D47 Collex
000D48 Aewin Technologies Co.
000D49 Triton Systems of Delaware
000D4A Steag ETA-Optik
000D4B Roku
000D4C Outline Electronics
000D4D Ninelanes
000D4E NDR Co.
000D4F Kenwood
000D50 Galazar Networks
000D51 Divr Systems
000D52 Comart system
000D53 Beijing 5w Communication
000D54 3Com Europe
000D55 Sanycom Technology Co.
000D56 Dell Pcba Test
000D57 Fujitsu I-Network Systems Limited.
000D58 Private
000D59 Amity Systems
000D5A Tiesse SpA
000D5B Smart Empire Investments Limited
000D5C Robert Bosch GmbH, Vt-atmo
000D5D Raritan Computer
000D5E NEC CustomTechnica
000D5F Minds
000D60 IBM
000D61 Giga-Byte Technology Co.
000D62 Funkwerk Dabendorf GmbH
000D63 Dent Instruments
000D64 Comag Handels AG
000D65 Cisco Systems
000D66 Cisco Systems
000D67 BelAir Networks
000D68 Vinci Systems
000D69 TMT&D
000D6A Redwood Technologies
000D6B Mita-Teknik A/S
000D6C M-Audio
000D6D K-Tech Devices
000D6E K-Patents Oy
000D6F Ember
000D70 Datamax
000D71 boca systems
000D72 2Wire
000D73 Technical Support
000D74 Sand Network Systems
000D75 Kobian Pte - Taiwan Branch
000D76 Hokuto Denshi Co
000D77 FalconStor Software
000D78 Engineering & Security
000D79 Dynamic Solutions Co
000D7A DiGATTO Asia Pacific Pte
000D7B Consensys Computers
000D7C Codian
000D7D Afco Systems
000D7E Axiowave Networks
000D7F Midas  Communication Technologies PTE ( Foreign Branch)
000D80 Online Development
000D81 Pepperl+Fuchs GmbH
000D82 PHS srl
000D83 Sanmina-SCI Hungary 
000D84 Makus
000D85 Tapwave
000D86 Huber + Suhner AG
000D87 Elitegroup Computer System Co. (ECS)
000D88 D-Link
000D89 Bils Technology
000D8A Winners Electronics Co.
000D8B T&D
000D8C Shanghai Wedone Digital CO.
000D8D ProLinx Communication Gateways
000D8E Koden Electronics Co.
000D8F King Tsushin Kogyo Co.
000D90 Factum Electronics AB
000D91 Eclipse (HQ Espana) S.L.
000D92 Arima Communication
000D93 Apple Computer
000D94 Afar Communications
000D95 Opti-cell
000D96 Vtera Technology
000D97 Tropos Networks
000D98 S.W.A.C. Schmitt-Walter Automation Consult GmbH
000D99 Orbital Sciences; Launch Systems Group
000D9A Infotec
000D9B Heraeus Electro-Nite International N.V.
000D9C Elan GmbH & Co KG
000D9D Hewlett Packard
000D9E Tokuden Ohizumi Seisakusyo Co.
000D9F RF Micro Devices
000DA0 Nedap N.V.
000DA1 Mirae ITS Co.
000DA2 Infrant Technologies
000DA3 Emerging Technologies Limited
000DA4 Dosch & Amand Systems AG
000DA5 Fabric7 Systems
000DA6 Universal Switching
000DA7 Private
000DA8 Teletronics Technology
000DA9 T.e.a.m. S.L.
000DAA S.A.Tehnology co.
000DAB Parker Hannifin GmbH Electromechanical Division Europe
000DAC Japan CBM
000DAD Dataprobe
000DAE Samsung Heavy Industries CO.
000DAF Plexus (UK)
000DB0 Olym-tech Co.
000DB1 Japan Network Service Co.
000DB2 Ammasso
000DB3 SDO Communication Corperation
000DB4 Netasq
000DB5 Globalsat Technology
000DB6 Teknovus
000DB7 Sanko Electric Co
000DB8 Schiller AG
000DB9 PC Engines GmbH
000DBA Oc Document Technologies GmbH
000DBB Nippon Dentsu Co.
000DBC Cisco Systems
000DBD Cisco Systems
000DBE Bel Fuse Europe
000DBF TekTone Sound & Signal Mfg.
000DC0 Spagat AS
000DC1 SafeWeb
000DC2 Private
000DC3 First Communication
000DC4 Emcore
000DC5 EchoStar International
000DC6 DigiRose Technology Co.
000DC7 Cosmic Engineering
000DC8 AirMagnet
000DC9 Thales Elektronik Systeme Gmbh
000DCA Tait Electronics
000DCB Petcomkorea Co.
000DCC Neosmart
000DCD Groupe Txcom
000DCE Dynavac Technology Pte
000DCF Cidra
000DD0 TetraTec Instruments GmbH
000DD1 Stryker
000DD2 Simrad Optronics ASA
000DD3 Samwoo Telecommunication Co.
000DD4 Revivio
000DD5 O'rite Technology Co.
000DD6 ITI
000DD7 Bright
000DD8 BBN
000DD9 Anton Paar GmbH
000DDA Allied Telesis K.K.
000DDB Airwave Technologies
000DDC VAC
000DDD Proflo Telra Elektronk Sanay VE Tcaret A..
000DDE Joyteck Co.
000DDF Japan Image & Network
000DE0 Icpdas Co.
000DE1 Control Products
000DE2 CMZ Sistemi Elettronici
000DE3 AT Sweden AB
000DE4 Diginics
000DE5 Samsung Thales
000DE6 Youngbo Engineering Co.
000DE7 Snap-on OEM Group
000DE8 Nasaco Electronics Pte.
000DE9 Napatech Aps
000DEA Kingtel Telecommunication
000DEB CompXs Limited
000DEC Cisco Systems
000DED Cisco Systems
000DEE Andrew RF Power Amplifier Group
000DEF Soc. Coop. Bilanciai
000DF0 Qcom Technology
000DF1 Ionix
000DF2 Private
000DF3 Asmax Solutions
000DF4 Watertek Co.
000DF5 Teletronics International
000DF6 Technology Thesaurus
000DF7 Space Dynamics Lab
000DF8 Orga Kartensysteme Gmbh
000DF9 NDS Limited
000DFA Micro Control Systems
000DFB Komax AG
000DFC Itfor Resarch and Development
000DFD Huges Hi-Tech,
000DFE Hauppauge Computer Works
000DFF Chenming Mold Industry
000E00 Atrie
000E01 Asip Technologies
000E02 Advantech AMT
000E03 Aarohi Communications
000E04 CMA/Microdialysis AB
000E05 Wireless Matrix
000E06 Team Simoco
000E07 Sony Ericsson Mobile Communications AB
000E08 Sipura Technology
000E09 Shenzhen Coship Software Co.
000E0A Sakuma Design Office
000E0B Netac Technology Co.
000E0C Intel
000E0D Hesch Schrder Gmbh
000E0E ESA elettronica S.P.A.
000E0F Ermme
000E10 Private
000E11 BDT Bro- und Datentechnik GmbH & Co. KG
000E12 Adaptive Micro Systems
000E13 Accu-Sort Systems
000E14 Visionary Solutions
000E15 Tadlys
000E16 SouthWing
000E17 Private
000E18 MyA Technology
000E19 LogicaCMG
000E1A JPS Communications
000E1B IAV GmbH
000E1C Hach Company
000E1D Arion Technology
000E1E Private
000E1F TCL Networks Equipment Co.
000E20 PalmSource
000E21 MTU Friedrichshafen GmbH
000E22 Private
000E23 Incipient
000E24 Huwell Technology
000E25 Hannae Technology Co.
000E26 Gincom Technology
000E27 Crere Networks
000E28 Dynamic Ratings P/L
000E29 Shester Communications
000E2A Private
000E2B Safari Technologies
000E2C Netcodec co.
000E2D Hyundai Digital Technology Co.
000E2E Edimax Technology Co.
000E2F Disetronic Medical Systems AG
000E30 Aeras Networks
000E31 Olympus BioSystems GmbH
000E32 Kontron Medical
000E33 Shuko Electronics Co.
000E34 NexGen City
000E35 Intel
000E36 Heinesys
000E37 Harms & Wende GmbH &KG
000E38 Cisco Systems
000E39 Cisco Systems
000E3A Cirrus Logic
000E3B Hawking Technologies
000E3C TransAct Technoloiges
000E3D Televic N.V.
000E3E Sun Optronics
000E3F Soronti
000E40 Nortel Networks
000E41 Nihon Mechatronics Co.
000E42 Motic Incoporation
000E43 G-Tek Electronics Sdn. Bhd.
000E44 Digital
000E45 Beijing Newtry Electronic Technology
000E46 Niigata Seimitsu Co.
000E47 NCI System Co.
000E48 Lipman TransAction Solutions
000E49 Forsway Scandinavia AB
000E4A Changchun Huayu Webpad Co.
000E4B atrium c and
000E4C Bermai
000E4D Numesa
000E4E Waveplus Technology Co.
000E4F Trajet GmbH
000E50 Thomson Telecom Belgium
000E51 tecna elettronica srl
000E52 Optium
000E53 AV Tech
000E54 AlphaCell Wireless
000E55 Auvitran
000E56 4G Systems GmbH
000E57 Iworld Networking
000E58 Sonos
000E59 Sagem SA
000E5A Telefield
000E5B ParkerVision - Direct2Data
000E5C Motorola BCS
000E5D Triple Play Technologies A/S
000E5E Beijing Raisecom Science & Technology Development Co.
000E5F activ-net GmbH & Co. KG
000E60 360SUN Digital Broadband
000E61 Microtrol Limited
000E62 Nortel Networks
000E63 Lemke Diagnostics GmbH
000E64 Elphel
000E65 TransCore
000E66 Hitachi Advanced Digital
000E67 Eltis Microelectronics
000E68 E-TOP Network Technology
000E69 China Electric Power Research Institute
000E6A 3com Europe
000E6B Janitza electronics GmbH
000E6C Device Drivers Limited
000E6D Murata Manufacturing Co.
000E6E Micrelec  Electronics S.A
000E6F Iris Berhad
000E70 in2 Networks
000E71 Gemstar Technology Development
000E72 CTS electronics
000E73 Tpack A/S
000E74 Solar Telecom. Tech
000E75 New York Air Brake
000E76 Gemsoc Innovision
000E77 Decru
000E78 Amtelco
000E79 Ample Communications
000E7A GemWon Communications Co.
000E7B Toshiba
000E7C Televes S.A.
000E7D Electronics Line 3000
000E7E Comprog Oy
000E7F Hewlett Packard
000E80 Thomson Technology
000E81 Devicescape Software
000E82 Commtech Wireless
000E83 Cisco Systems
000E84 Cisco Systems
000E85 Catalyst Enterprises
000E86 Alcatel North America
000E87 adp Gauselmann GmbH
000E88 Videotron
000E89 Clematic
000E8A Avara Technologies
000E8B Astarte Technology Co
000E8C Siemens AG A&D ET
000E8D Systems in Progress Holding GmbH
000E8E SparkLAN Communications
000E8F Sercomm
000E90 Ponico
000E91 Northstar Technologies
000E92 Millinet Co.
000E93 Milnio 3 Sistemas Electrnicos
000E94 Maas International BV
000E95 Fujiya Denki Seisakusho Co.
000E96 Cubic Defense Applications
000E97 Ultracker Technology CO.
000E98 Vitec CC
000E99 Spectrum Digital
000E9A BOE Technology Group Co.
000E9B Ambit Microsystems
000E9C Pemstar
000E9D Video Networks
000E9E Topfield Co.
000E9F Temic SDS Gmbh
000EA0 NetKlass Technology
000EA1 Formosa Teletek
000EA2 CyberGuard
000EA3 Cncr-it Co.,ltd,hangzhou P.r.china
000EA4 Certance
000EA5 Blip Systems
000EA6 Asustek Computer
000EA7 Endace
000EA8 United Technologists Europe Limited
000EA9 Shanghai Xun Shi Communications Equipment Co.
000EAA Scalent Systems
000EAB OctigaBay Systems
000EAC Mintron Enterprise CO.
000EAD Metanoia Technologies
000EAE Gawell Technologies
000EAF Castel
000EB0 Solutions Radio BV
000EB1 Newcotech
000EB2 Micro-Research Finland Oy
000EB3 LeftHand Networks
000EB4 Guangzhou Gaoke Communications Technologyltd.
000EB5 Ecastle Electronics Co.
000EB6 Riverbed Technology
000EB7 Knovative
000EB8 Iiga co.
000EB9 Hashimoto Electronics Industry Co.
000EBA Hanmi Semiconductor CO.
000EBB Everbee Networks
000EBC Cullmann GmbH
000EBD Burdick, a Quinton Compny
000EBE B&B Electronics Manufacturing Co.
000EBF Remsdaq Limited
000EC0 Nortel Networks
000EC1 Mynah Technologies
000EC2 Lowrance Electronics
000EC3 Logic Controls
000EC4 Iskra Transmission d.d.
000EC5 Digital Multitools
000EC6 Asix Electronics
000EC7 Motorola Korea
000EC8 Zoran
000EC9 Yoko Technology
000ECA Wtss
000ECB VineSys Technology
000ECC Tableau
000ECD Skov A/S
000ECE S.I.T.T.I. S.p.A.
000ECF Profibus Nutzerorganisation e.V.
000ED0 Privaris
000ED1 Osaka Micro Computer.
000ED2 Filtronic plc
000ED3 Epicenter
000ED4 Cresitt Industrie
000ED5 Copan Systems
000ED6 Cisco Systems
000ED7 Cisco Systems
000ED8 Aktino
000ED9 Aksys
000EDA C-tech United
000EDB XiNCOM
000EDC Tellion
000EDD Shure Incorporated
000EDE Remec
000EDF PLX Technology
000EE0 Mcharge
000EE1 ExtremeSpeed
000EE2 Custom Engineering S.p.A.
000EE3 Chiyu Technology Co.
000EE4 BOE Technology Group Co.
000EE5 bitWallet
000EE6 Adimos Systems
000EE7 AAC Electronics
000EE8 zioncom
000EE9 WayTech Development
000EEA Shadong Luneng Jicheng Electronics,Co.
000EEB Sandmartin(zhong shan)Electronics Co.
000EEC Orban
000EED Nokia Danmark A/S
000EEE Muco Industrie BV
000EEF Private
000EF0 Festo AG & Co. KG
000EF1 Ezquest
000EF2 Infinico
000EF3 Smarthome
000EF4 Shenzhen Kasda Digital Technology Co.
000EF5 iPAC Technology Co.
000EF6 E-TEN Information Systems Co.
000EF7 Vulcan Portals
000EF8 SBC ASI
000EF9 REA Elektronik GmbH
000EFA Optoway Technology Incorporation
000EFB Macey Enterprises
000EFC Jtag Technologies B.V.
000EFD Fuji Photo Optical CO.
000EFE EndRun Technologies
000EFF Megasolution
000F00 Legra Systems
000F01 Digitalks
000F02 Digicube Technology Co.
000F03 Com&c CO.
000F04 cim-usa
000F05 3B System
000F06 Nortel Networks
000F07 Mangrove Systems
000F08 Indagon Oy
000F09 Private
000F0A Clear Edge Networks
000F0B Kentima Technologies AB
000F0C Synchronic Engineering
000F0D Hunt Electronic Co.
000F0E WaveSplitter Technologies
000F0F Real ID Technology Co.
000F10 RDM
000F11 Prodrive B.V.
000F12 Panasonic AVC Networks Germany GmbH
000F13 Nisca
000F14 Mindray Co.
000F15 Kjaerulff1 A/S
000F16 JAY HOW Technology CO.,
000F17 Insta Elektro GmbH
000F18 Industrial Control Systems
000F19 Guidant
000F1A Gaming Support B.V.
000F1B Ego Systems
000F1C DigitAll World Co.
000F1D Cosmo Techs Co.
000F1E Chengdu KT Electricof High & New Technology
000F1F WW Pcba Test
000F20 Hewlett Packard
000F21 Scientific Atlanta
000F22 Helius
000F23 Cisco Systems
000F24 Cisco Systems
000F25 AimValley B.V.
000F26 WorldAccxx 
000F27 Teal Electronics
000F28 Itronix
000F29 Augmentix
000F2A Cableware Electronics
000F2B Greenbell Systems
000F2C Uplogix
000F2D Chung-hsin Electric & Machinery Mfg.corp.
000F2E Megapower International
000F2F W-linx Technology CO.
000F30 Raza Microelectronics
000F31 Prosilica
000F32 LuTong Electronic Technology Co.
000F33 Duali
000F34 Cisco Systems
000F35 Cisco Systems
000F36 Accurate Techhnologies
000F37 Xambala Incorporated
000F38 Netstar
000F39 Iris Sensors
000F3A Hisharp
000F3B Fuji System Machines Co.
000F3C Endeleo Limited
000F3D D-Link
000F3E CardioNet
000F3F Big Bear Networks
000F40 Optical Internetworking Forum
000F41 Zipher
000F42 Xalyo Systems
000F43 Wasabi Systems
000F44 Tivella
000F45 Stretch
000F46 Sinar AG
000F47 Robox SPA
000F48 Polypix
000F49 Northover Solutions Limited
000F4A Kyushu-kyohan co.
000F4B Katana Technology
000F4C Elextech
000F4D Centrepoint Technologies
000F4E Cellink
000F4F Cadmus Technology
000F50 Baxall Limited
000F51 Azul Systems
000F52 York Refrigeration, Marine & Controls
000F53 Level 5 Networks
000F54 Entrelogic
000F55 Datawire Communication Networks
000F56 Continuum Photonics
000F57 Cablelogic Co.
000F58 Adder Technology Limited
000F59 Phonak Communications AG
000F5A Peribit Networks
000F5B Delta Information Systems
000F5C Day One Digital Media Limited
000F5D 42Networks AB
000F5E Veo
000F5F Nicety Technologies (NTS)
000F60 Lifetron Co.
000F61 Kiwi Networks
000F62 Alcatel Bell Space N.V.
000F63 Obzerv Technologies
000F64 D&R Electronica Weesp BV
000F65 icube
000F66 Cisco-Linksys
000F67 West Instruments
000F68 Vavic Network Technology
000F69 SEW Eurodrive GmbH & Co. KG
000F6A Nortel Networks
000F6B GateWare Communications GmbH
000F6C Addi-data Gmbh
000F6D Midas Engineering
000F6E BBox
000F6F FTA Communication Technologies
000F70 Wintec Industries
000F71 Sanmei Electronics Co.
000F72 Sandburst
000F73 Rockwell Samsung Automation
000F74 Qamcom Technology AB
000F75 First Silicon Solutions
000F76 Digital Keystone
000F77 Dentum Co.
000F78 Datacap Systems
000F79 Bluetooth Interest Group
000F7A BeiJing NuQX Technology CO.
000F7B Arce Sistemas
000F7C ACTi
000F7D Xirrus
000F7E UIS Abler Electronics Co.
000F7F Ubstorage Co.
000F80 Trinity Security Systems
000F81 Secure Info Imaging
000F82 Mortara Instrument
000F83 Brainium Technologies
000F84 Astute Networks
000F85 Addo-japan
000F86 Research In Motion Limited
000F87 Maxcess International
000F88 Ametek
000F89 Winnertec System Co.
000F8A WideView
000F8B Orion MultiSystems
000F8C Gigawavetech Pte
000F8D Fast Tv-server AG
000F8E Dongyang Telecom Co.
000F8F Cisco Systems
000F90 Cisco Systems
000F91 Aerotelecom Co.
000F92 Microhard Systems
000F93 Landis+Gyr
000F94 Genexis
000F95 Elecom Co.,ltd Laneed Division
000F96 Critical Telecom
000F97 Avanex
000F98 Avamax Co.
000F99 Apac Opto Electronics
000F9A Synchrony
000F9B Ross Video Limited
000F9C Panduit
000F9D Newnham Research
000F9E Murrelektronik GmbH
000F9F Motorola BCS
000FA0 Canon Korea Business Solutions
000FA1 Gigabit Systems
000FA2 Digital Path Networks
000FA3 Alpha Networks
000FA4 Sprecher Automation GmbH
000FA5 SMP / BWA Technology GmbH
000FA6 S2 Security
000FA7 Raptor Networks Technology
000FA8 Photometrics
000FA9 PC Fabrik
000FAA Nexus Technologies
000FAB Kyushu Electronics Systems
000FAC Ieee 802.11
000FAD FMN communications GmbH
000FAE E2O Communications
000FAF Dialog
000FB0 Compal Electronics
000FB1 Cognio
000FB2 Broadband Pacenet (India) Pvt.
000FB3 Actiontec Electronics
000FB4 Timespace Technology
000FB5 Netgear
000FB6 Europlex Technologies
000FB7 Cavium Networks
000FB8 CallURL
000FB9 Adaptive Instruments
000FBA Tevebox AB
000FBB Siemens AG, ICN M&L TDC EP
000FBC Onkey Technologies
000FBD MRV Communications (Networks)
000FBE e-w/you
000FBF DGT Sp. z o.o.
000FC0 Delcomp
000FC1 Wave
000FC2 Uniwell
000FC3 PalmPalm Technology
000FC4 NST co.
000FC5 KeyMed
000FC6 Eurocom Industries A/S
000FC7 Dionica R&D
000FC8 Chantry Networks
000FC9 Allnet GmbH
000FCA A-jin Techline CO
000FCB 3com Europe
000FCC Netopia
000FCD Nortel Networks
000FCE Kikusui Electronics
000FCF Datawind Research
000FD0 Astri
000FD1 Applied Wireless Identifications Group
000FD2 EWA Technologies
000FD3 Digium
000FD4 Soundcraft
000FD5 Schwechat - Rise
000FD6 Sarotech Co.
000FD7 Harman Music Group
000FD8 Force
000FD9 FlexDSL Telecommunications AG
000FDA Yazaki
000FDB Westell Technologies
000FDC Ueda Japan  Radio Co.
000FDD Sordin AB
000FDE Sony Ericsson Mobile Communications AB
000FDF Solomon Technology
000FE0 NComputing Co.
000FE1 ID Digital
000FE2 Hangzhou Huawei-3Com Tech. Co.
000FE3 Damm Cellular Systems A/S
000FE4 Pantech Co.
000FE5 Mercury Security
000FE6 MBTech Systems
000FE7 Lutron Electronics Co.
000FE8 Lobos
000FE9 GW Technologies Co.
000FEA Giga-Byte Technology Co.
000FEB Cylon Controls
000FEC Arkus
000FED Anam Electronics Co.
000FEE XTec, Incorporated
000FEF Thales e-Transactions GmbH
000FF0 Sunray Enterprise
000FF1 nex-G Systems Pte.Ltd
000FF2 Loud Technologies
000FF3 Jung Myoung Communications&Technology
000FF4 Guntermann & Drunck GmbH
000FF5 GN&S company
000FF6 Darfon Electronics
000FF7 Cisco Systems
000FF8 Cisco  Systems
000FF9 Valcretec
000FFA Optinel Systems
000FFB Nippon Denso Industry Co.
000FFC Merit Li-Lin Ent.
000FFD Glorytek Network
000FFE G-pro Computer
000FFF Control4
001000 Cable Television Laboratories
001001 MCK Communications
001002 Actia
001003 Imatron
001004 THE Brantley Coile Company
001005 UEC Commercial
001006 Thales Contact Solutions
001007 Cisco Systems
001008 Vienna Systems
001009 Horo Quartz
00100A Williams Communications Group
00100B Cisco Systems
00100C ITO CO.
00100D Cisco Systems
00100E Micro Linear Coporation
00100F Industrial CPU Systems
001010 Initio
001011 Cisco Systems
001012 Processor Systems (I) PVT
001013 Kontron
001014 Cisco Systems
001015 OOmon
001016 T.sqware
001017 Micos Gmbh
001018 Broadcom
001019 Sirona Dental Systems Gmbh & Co. KG
00101A PictureTel
00101B Cornet Technology
00101C OHM Technologies INTL
00101D Winbond Electronics
00101E Matsushita Electronic Instruments
00101F Cisco Systems
001020 Welch Allyn, Data Collection
001021 Encanto Networks
001022 SatCom Media
001023 Flowwise Networks
001024 Nagoya Electric Works CO.
001025 Grayhill
001026 Accelerated Networks
001027 L-3 Communications East
001028 Computer Technica
001029 Cisco Systems
00102A ZF Microsystems
00102B Umax Data Systems
00102C Lasat Networks A/S
00102D Hitachi Software Engineering
00102E Network Systems & Technologies PVT.
00102F Cisco Systems
001030 Wi-LAN
001031 Objective Communications
001032 Alta Technology
001033 Accesslan Communications
001034 GNP Computers
001035 Elitegroup Computer Systems CO.
001036 Inter-tel Integrated Systems
001037 CYQ've Technology Co.
001038 Micro Research Institute
001039 Vectron Systems AG
00103A Diamond Network Tech
00103B Hippi Networking Forum
00103C IC Ensemble
00103D Phasecom
00103E Netschools
00103F Tollgrade Communications
001040 Intermec
001041 Bristol Babcock
001042 AlacriTech
001043 A2
001044 InnoLabs
001045 Nortel Networks
001046 Alcorn Mcbride
001047 Echo Eletric CO.
001048 Htrc Automation
001049 Shoreline Teleworks
00104A THE Parvuc
00104B 3com
00104C Computer Access Technology
00104D Surtec Industries
00104E Ceologic
00104F Storage Technology
001050 Rion CO.
001051 Cmicro
001052 Mettler-toledo (albstadt) Gmbh
001053 Computer Technology
001054 Cisco Systems
001055 Fujitsu Microelectronics
001056 Sodick CO.
001057 Rebel.com
001058 ArrowPoint Communications
001059 Diablo Research CO.
00105A 3com
00105B NET Insight AB
00105C Quantum Designs (h.k.)
00105D Draeger Medical
00105E Hekimian Laboratories
00105F In-snec
001060 Billionton Systems
001061 Hostlink
001062 NX Server
001063 Starguide Digital Networks
001064 DNPG
001065 Radyne
001066 Advanced Control Systems
001067 Redback Networks
001068 Comos Telecom
001069 Helioss Communications
00106A Digital Microwave
00106B Sonus Networks
00106C Infratec Plus Gmbh
00106D Integrity Communications
00106E Tadiran COM.
00106F Trenton Technology
001070 Caradon Trend
001071 Advanet
001072 GVN Technologies
001073 Technobox
001074 Aten International CO.
001075 Maxtor
001076 Eurem Gmbh
001077 SAF Drive Systems
001078 Nuera Communications
001079 Cisco Systems
00107A AmbiCom
00107B Cisco Systems
00107C P-com
00107D Aurora Communications
00107E Bachmann Electronic Gmbh
00107F Crestron Electronics
001080 Metawave Communications
001081 DPS
001082 JNA Telecommunications Limited
001083 Hewlett-packard Company
001084 K-bot Communications
001085 Polaris Communications
001086 Atto Technology
001087 Xstreamis PLC
001088 American Networks
001089 WebSonic
00108A TeraLogic
00108B Laseranimation Sollinger Gmbh
00108C Fujitsu Telecommunications Europe
00108D Johnson Controls
00108E Hugh Symons Concept Technologies
00108F Raptor Systems
001090 Cimetrics
001091 NO Wires Needed BV
001092 Netcore
001093 CMS Computers
001094 Performance Analysis Broadband, Spirent plc
001095 Thompson
001096 Tracewell Systems
001097 WinNet Metropolitan Communications Systems
001098 Starnet Technologies
001099 InnoMedia
00109A Netline
00109B Emulex
00109C M-system CO.
00109D Clarinet Systems
00109E Aware
00109F PAVO
0010A0 Innovex Technologies
0010A1 Kendin Semiconductor
0010A2 TNS
0010A3 Omnitronix
0010A4 Xircom
0010A5 Oxford Instruments
0010A6 Cisco Systems
0010A7 Unex Technology
0010A8 Reliance Computer
0010A9 Adhoc Technologies
0010AA Media4
0010AB Koito Industries
0010AC Imci Technologies
0010AD Softronics USB
0010AE Shinko Electric Industries CO.
0010AF TAC Systems
0010B0 Meridian Technology
0010B1 For-a CO.
0010B2 Coactive Aesthetics
0010B3 Nokia Multimedia Terminals
0010B4 Atmosphere Networks
0010B5 Accton Technology
0010B6 Entrata Communications
0010B7 Coyote Technologies
0010B8 Ishigaki Computer System CO.
0010B9 Maxtor
0010BA Martinho-davis Systems
0010BB Data & Information Technology
0010BC Aastra Telecom
0010BD THE Telecommunication Technology Committee
0010BE Telexis
0010BF InterAir Wireless
0010C0 ARMA
0010C1 OI Electric CO.
0010C2 Willnet
0010C3 Csi-control Systems
0010C4 Media Links CO.
0010C5 Protocol Technologies
0010C6 USI
0010C7 Data Transmission Network
0010C8 Communications Electronics Security Group
0010C9 Mitsubishi Electronics Logistic Support CO.
0010CA Integral Access
0010CB Facit K.K.
0010CC CLP Computer Logistik Planung Gmbh
0010CD Interface Concept
0010CE Volamp
0010CF Fiberlane Communications
0010D0 Witcom
0010D1 Top Layer Networks
0010D2 Nitto Tsushinki CO.
0010D3 Grips Electronic Gmbh
0010D4 Storage Computer
0010D5 Imasde Canarias
0010D6 ITT - A/cd
0010D7 Argosy Research
0010D8 Calista
0010D9 IBM Japan, Fujisawa Mt+d
0010DA Motion Engineering
0010DB Juniper Networks
0010DC Micro-star International CO.
0010DD Enable Semiconductor
0010DE International Datacasting
0010DF Rise Computer
0010E0 Cobalt Microserver
0010E1 S.I. TECH
0010E2 ArrayComm
0010E3 Compaq Computer
0010E4 NSI
0010E5 Solectron Texas
0010E6 Applied Intelligent Systems
0010E7 BreezeCom
0010E8 Telocity, Incorporated
0010E9 Raidtec
0010EA Adept Technology
0010EB Selsius Systems
0010EC RPCG
0010ED Sundance Technology
0010EE CTI Products
0010EF Dbtel Incorporated
0010F1 I-O
0010F2 Antec
0010F3 Nexcom International Co.
0010F4 Vertical Networks
0010F5 Amherst Systems
0010F6 Cisco Systems
0010F7 Iriichi Technologies
0010F8 Kenwood TMI
0010F9 Unique Systems
0010FA Zayante
0010FB Zida Technologies Limited
0010FC Broadband Networks
0010FD Cocom A/S
0010FE Digital Equipment
0010FF Cisco Systems
001100 RAM Industries
001101 CET Technologies Pte
001102 Aurora Multimedia
001103 kawamura electric
001104 Telexy
001105 Sunplus Technology Co.
001106 Siemens NV (Belgium)
001107 RGB Networks
001108 Orbital Data
001109 Micro-Star International
00110A Hewlett Packard
00110B Franklin Technology Systems
00110C Atmark Techno
00110D Sanblaze Technology
00110E Tsurusaki Sealand Transportation Co.
00110F netplat
001110 Maxanna Technology Co.
001111 Intel
001112 Honeywell Cmss
001113 Fraunhofer Fokus
001114 EverFocus Electronics
001115 Epin Technologies
001116 Coteau Vert CO.
001117 Cesnet
001118 BLX IC Design
001119 Solteras
00111A Motorola BCS
00111B Targa Systems Div L-3 Communications Canada
00111C Pleora Technologies
00111D Hectrix Limited
00111E Epsg (ethernet Powerlink Standardization Group)
00111F Doremi Labs
001120 Cisco Systems
001121 Cisco Systems
001122 Cimsys
001123 Appointech
001124 Apple Computer
001125 IBM
001126 Venstar
001127 TASI
001128 Streamit
001129 Paradise Datacom
00112A Niko NV
00112B NetModule
00112C IZT GmbH
00112D Guys Without Ties
00112E Ceicom
00112F Asustek Computer
001130 Allied Telesis (Hong Kong)
001131 Unatech. Co.
001132 Synology Incorporated
001133 Siemens Austria Simea
001134 MediaCell
001135 Grandeye
001136 Goodrich Sensor Systems
001137 Aichi Electric CO.
001138 Taishin CO.
001139 Stoeber Antriebstechnik Gmbh + Co. KG.
00113A Shinboram
00113B Micronet Communications
00113C Micronas GmbH
00113D KN Soltec Co.
00113E JL
00113F Alcatel DI
001140 Nanometrics
001141 GoodMan
001142 E-smartcom 
001143 Dell
001144 Assurance Technology
001145 ValuePoint Networks
001146 Telecard-Pribor
001147 Secom-IndustryLTD.
001148 Prolon Control Systems
001149 Proliphix
00114A Kayaba Industry Co
00114B Francotyp-Postalia AG & Co. KG
00114C caffeina applied research
00114D Atsumi Electric Co.
00114E 690885 Ontario
00114F US Digital Television
001150 Belkin
001151 Mykotronx
001152 Eidsvoll Electronics AS
001153 Trident Tek
001154 Webpro Technologies
001155 Sevis Systems
001156 Pharos Systems NZ
001157 OF Networks Co.
001158 Nortel Networks
001159 Matisse Networks
00115A Ivoclar Vivadent AG
00115B Elitegroup Computer System Co. (ECS)
00115C Cisco
00115D Cisco
00115E ProMinent Dosiertechnik GmbH
00115F Intellix Co.
001160 Artdio Company Co.
001161 NetStreams
001162 Star Micronics Co.
001163 System SPA DEPT. Electronics
001164 Acard Technology
001165 Znyx Networks
001166 Taelim Electronics Co.
001167 Integrated System Solution
001168 HomeLogic
001169 EMS Satcom
00116A Domo
00116B Digital Data Communications Asia Co.
00116C Nanwang Multimedia
00116D American Time and Signal
00116E PePLink
00116F Netforyou Co.
001170 GSC SRL
001171 Dexter Communications
001172 Cotron
001173 Adtron
001174 Wibhu Technologies
001175 PathScale
001176 Intellambda Systems
001177 Coaxial Networks
001178 Chiron Technology
001179 Singular Technology Co.
00117A Singim International
00117B Bchi Labortechnik AG
00117C e-zy.net
00117D ZMD America
00117E Progeny
00117F Neotune Information Technology
001180 Motorola BCS
001181 InterEnergyLtd,
001182 IMI Norgren
001183 PSC Scanning
001184 Humo Laboratory
001185 Hewlett Packard
001186 Prime Systems
001187 Category Solutions
001188 Enterasys
001189 Aerotech
00118A Viewtran Technology Limited
00118B NetDevices
00118C Missouri Department of Transportation
00118D Hanchang System
00118E Halytech Mace
00118F Eutech Instruments PTE.
001190 Digital Design
001191 CTS-Clima Temperatur Systeme GmbH
001192 Cisco Systems
001193 Cisco Systems
001194 Chi Mei Communication Systems
001195 D-Link
001196 Actuality Systems
001197 Monitoring Technologies Limited
001198 Prism Media Products Limited
001199 2wcom GmbH
00119A Alkeria srl
00119B Telesynergy Research
00119C EP&T Energy
00119D Diginfo Technology
00119E Solectron Brazil
00119F Nokia Danmark A/S
0011A0 Vtech Engineering Canada
0011A1 Vision Netware Co.
0011A2 Manufacturing Technology
0011A3 LanReady Technologies
0011A4 JStream Technologies
0011A5 Fortuna Electronic
0011A6 Sypixx Networks
0011A7 Infilco Degremont
0011A8 Quest Technologies
0011A9 Moimstone Co.
0011AA Uniclass Technology, Co.
0011AB Trustable Technology Co.
0011AC Simtec Electronics
0011AD Shanghai Ruijie Technology
0011AE Motorola BCS
0011AF Medialink-i
0011B0 Fortelink
0011B1 BlueExpert Technology
0011B2 2001 Technology
0011B3 Yoshimiya Co.
0011B4 Westermo Teleindustri AB
0011B5 Shenzhen Powercom Co.
0011B6 Open Systems International
0011B7 Melexis Nederland B.V.
0011B8 Liebherr - Elektronik GmbH
0011B9 Inner Range
0011BA Elexol
0011BB Cisco Systems
0011BC Cisco Systems
0011BD Bombardier Transportation
0011BE AGP Telecom Co.
0011BF Aesys S.p.a.
0011C0 Aday Technology
0011C1 4P Mobile Data Processing
0011C2 United Fiber Optic Communication
0011C3 Transceiving System Technology
0011C4 Terminales de Telecomunicacion Terrestre
0011C5 TEN Technology
0011C6 Seagate Technology
0011C7 Raymarine Group
0011C8 Powercom Co.
0011C9 MTT
0011CA Long Range Systems
0011CB Jacobsons RKH AB
0011CC Guangzhou Jinpeng Group Co.
0011CD Axsun Technologies
0011CE Ubisense Limited
0011CF Thrane & Thrane A/S
0011D0 Tandberg Data ASA
0011D1 Soft Imaging System GmbH
0011D2 Perception Digital
0011D3 NextGenTel Holding ASA
0011D4 NetEnrich
0011D5 Hangzhou Sunyard System Engineering Co.
0011D6 HandEra
0011D7 eWerks
0011D8 Asustek Computer
0011D9 TiVo
0011DA Vivaas Technology
0011DB Land-Cellular
0011DC Glunz & Jensen
0011DD Fromus TEC. Co.
0011DE Eurilogic
0011DF Arecont Systems
0011E0 U-media Communications
0011E1 Beko Electronics Co.
0011E2 Hua Jung Components Co.
0011E3 Broadband Access Products
0011E4 Danelec Electronics A/S
0011E5 KCodes
0011E6 Scientific Atlanta
0011E7 Worldsat - Texas de France
0011E8 Tixi.Com
0011E9 Starnex CO.
0011EA Iwics
0011EB Innovative Integration
0011EC Avix
0011ED 802 Global
0011EE Estari
0011EF Conitec Datensysteme GmbH
0011F0 Wideful Limited
0011F1 QinetiQ
0011F2 Institute of Network Technologies
0011F3 Gavitec AG- mobile digit
0011F4 woori-net
0011F5 Askey Computer
0011F6 Asia Pacific Microsystems 
0011F7 Shenzhen Forward Industry Co.
0011F8 Airaya
0011F9 Nortel Networks
0011FA Rane
0011FB Heidelberg Engineering GmbH
0011FC Harting Electric Gmbh &KG
0011FD Korg
0011FE Keiyo System Research
0011FF Digitro Tecnologia Ltda
001200 Cisco
001201 Cisco
001202 Audio International
001203 Activ Networks
001204 u10 Networks
001205 Terrasat Communications
001206 iQuest (NZ)
001207 Head Strong International Limited
001208 Gantner Electronic GmbH
001209 Fastrax
00120A Emerson Electric GmbH & Co. OHG
00120B Chinasys Technologies Limited
00120C CE-Infosys Pte
00120D Advanced Telecommunication Technologies
00120E AboCom
00120F Ieee 802.3
001210 WideRay
001211 Protechna Herbst GmbH & Co. KG
001212 Plus Vision
001213 Metrohm AG
001214 Koenig & Bauer AG
001215 iStor Networks
001216 ICP Internet Communication Payment AG
001217 Cisco-Linksys
001218 Aruze
001219 Ahead Communication Systems
00121A Techno Soft Systemnics
00121B Sound Devices
00121C Parrot S.A.
00121D Netfabric
00121E Juniper Networks
00121F Harding Intruments
001220 Cadco Systems
001221 B.Braun Melsungen AG
001222 Skardin (UK)
001223 Pixim
001224 NexQL
001225 Motorola BCS
001226 Japan Direx
001227 Franklin Electric Co.
001228 Data
001229 BroadEasy Technologies Co.
00122A VTech Telecommunications
00122B Virbiage
00122C Soenen Controls N.V.
00122D SiNett
00122E Signal Technology - Aisd
00122F Sanei Electric
001230 Picaso Infocommunication CO.
001231 Motion Control Systems
001232 LeWiz Communications
001233 JRC Tokki Co.
001234 Camille Bauer
001235 Andrew
001236 Tidal Networks
001237 Texas Instruments
001238 SetaBox Technology Co.
001239 S Net Systems
00123A Posystech
00123B KeRo Systems ApS
00123C IP3 Networks
00123D GES
00123E Erune Technology Co.
00123F Dell
001240 Amoi Electronics Co.
001241 a2i marketing center
001242 Millennial Net
001243 Cisco
001244 Cisco
001245 Zellweger Analytics
001246 T.O.M Technology.
001247 Samsung Electronics Co.
001248 Kashya
001249 Delta Elettronica S.p.A.
00124A Dedicated Devices
00124B Chipcon AS
00124C Bbwm
00124D Inducon BV
00124E XAC Automation
00124F Tyco Thermal Controls
001250 Tokyo Aircaft Instrument Co.
001251 Silink
001252 Citronix
001253 AudioDev AB
001254 Spectra Technologies Holdings Company
001255 NetEffect Incorporated
001256 LG Information & COMM.
001257 LeapComm Communication Technologies
001258 Activis Polska
001259 Thermo Electron Karlsruhe
00125A Microsoft
00125B Kaimei Electroni
00125C Green Hills Software
00125D CyberNet
00125E Caen
00125F Awind
001260 Stanton Magnetics
001261 Adaptix
001262 Nokia Danmark A/S
001263 Data Voice Technologies GmbH
001264 daum electronic gmbh
001265 Enerdyne Technologies
001266 Private
001267 Matsushita Electronic Components Co.
001268 IPS d.o.o.
001269 Value Electronics
00126A Optoelectronics Co.
00126B Ascalade Communications Limited
00126C Visonic
00126D University of California, Berkeley
00126E Seidel Elektronik GmbH Nfg.KG
00126F Rayson Technology Co.
001270 Nges Denro Systems
001271 Measurement Computing
001272 Redux Communications
001273 Stoke
001274 NIT lab
001275 Moteiv
001276 Microsol Holdings
001277 Korenix Technologies Co.
001278 International Bar Code
001279 Hewlett Packard
00127A Sanyu Industry Co.
00127B VIA Networking Technologies
00127C Swegon AB
00127D MobileAria
00127E Digital Lifestyles Group
00127F Cisco
001280 Cisco
001281 Cieffe srl
001282 Qovia
001283 Nortel Networks
001284 Lab33 Srl
001285 Gizmondo Europe
001286 Endevco
001287 Digital Everywhere Unterhaltungselektronik GmbH
001288 2Wire
001289 Advance Sterilization Products
00128A Motorola PCS
00128B Sensory Networks
00128C Woodward Governor
00128D STB Datenservice GmbH
00128E Q-Free ASA
00128F Montilio
001290 Kyowa Electric & Machinery
001291 KWS Computersysteme GmbH
001292 Griffin Technology
001293 GE Energy
001294 Eudyna Devices
001295 Aiware
001296 Addlogix
001297 O2Micro
001298 Mico Electric(shenzhen) Limited
001299 Ktech Telecommunications
00129A IRT Electronics
00129B E2S Electronic Engineering Solutions
00129C Yulinet
00129D First International Computer DO Brasil Ltda
00129E Surf Communications
00129F RAE Systems
0012A0 NeoMeridian Sdn Bhd
0012A1 BluePacket Communications Co.
0012A2 Vita
0012A3 Trust International B.V.
0012A4 ThingMagic
0012A5 Stargen
0012A6 Lake Technology
0012A7 ISR Technologies
0012A8 intec GmbH
0012A9 3com Europe
0012AA IEE
0012AB WiLife
0012AC Ontimetek
0012AD IDS GmbH
0012AE HLS Hard-line Solutions
0012AF Elpro Technologies
0012B0 Efore Oyj   (Plc)
0012B1 Dai Nippon Printing Co.
0012B2 Avolites
0012B3 Advance Wireless Technology
0012B4 Work GmbH
0012B5 Vialta
0012B6 Santa Barbara Infrared
0012B7 PTW Freiburg
0012B8 G2 Microsystems
0012B9 Fusion Digital Technology
0012BA FSI Systems
0012BB Telecommunications Industry Association TR-41 Committee
0012BC Echolab
0012BD Avantec Manufacturing Limited
0012BE Astek
0012BF Arcadyan Technology
0012C0 HotLava Systems
0012C1 Check Point Software Technologies
0012C2 Apex Electronics Factory
0012C3 WIT S.A.
0012C4 Viseon
0012C5 V-Show TechnologyLtd
0012C6 TGC America
0012C7 Securay Technologiesco.
0012C8 Perfect tech
0012C9 Motorola BCS
0012CA Hansen Telecom
0012CB CSS
0012CC Bitatek CO.
0012CD Asem SpA
0012CE Advanced Cybernetics Group
0012CF Accton Technology
0012D0 Gossen-Metrawatt-GmbH
0012D1 Texas Instruments
0012D2 Texas Instruments
0012D3 Zetta Systems
0012D4 Princeton Technology
0012D5 Motion Reality
0012D6 Jiangsu Yitong High-Tech Co.
0012D7 Invento Networks
0012D8 International Games System Co.
0012D9 Cisco Systems
0012DA Cisco Systems
0012DB Ziehl Industrie-elektronik Gmbh + Co KG
0012DC SunCorp Industrial Limited
0012DD Shengqu Information Technology (Shanghai) Co.
0012DE Radio Components Sweden AB
0012DF Novomatic AG
0012E0 Codan Limited
0012E1 Alliant Networks
0012E2 Alaxala Networks
0012E3 Agat-RT
0012E4 Ziehl Industrie-electronik Gmbh + Co KG
0012E5 Time America
0012E6 Spectec Computer CO.
0012E7 Projectek Networking Electronics
0012E8 Fraunhofer IMS
0012E9 Abbey Systems
0012EA Trane
0012EB R2DI
0012EC Movacolor b.v.
0012ED AVG Advanced Technologies
0012EE Sony Ericsson Mobile Communications AB
0012EF OneAccess SA
0012F0 Intel Corporate
0012F1 Ifotec
0012F2 Foundry Networks
0012F3 connectBlue AB
0012F4 Belco International Co.
0012F5 Prolificx
0012F6 MDK Co.
0012F7 Xiamen Xinglian Electronics Co.
0012F8 WNI Resources
0012F9 Uryu Seisaku
0012FA THX
0012FB Samsung Electronics
0012FC Planet System Co.
0012FD Optimus IC S.A.
0012FE Lenovo Mobile Communication Technology
0012FF Lely Industries N.V.
001300 It-factory
001301 IronGate S.L.
001302 Intel Corporate
001303 GateConnect Technologies GmbH
001304 Flaircomm Technologies Co.
001305 Epicom
001306 Always On Wireless
001307 Paravirtual
001308 Nuvera Fuel Cells
001309 Ocean Broadband Networks
00130A Nortel
00130B Mextal B.V.
00130C HF System
00130D Galileo Avionica
00130E Focusrite Audio Engineering Limited
00130F Egemen Bilgisayar Muh San ve Tic STI
001310 Cisco-Linksys
001311 Arris International
001312 Amedia Networks
001313 GuangZhou Post & Telecom Equipment
001314 Asiamajor
001315 Sony Computer Entertainment,
001316 L-S-B GmbH
001317 GN Netcom as
001318 Dgstation Co.
001319 Cisco Systems
00131A Cisco Systems
00131B BeCell Innovations
00131C LiteTouch
00131D Scanvaegt International A/S
00131E Peiker acustic GmbH & Co. KG
00131F NxtPhase T&D
001320 Intel Corporate
001321 Hewlett Packard
001322 DAQ Electronics
001323 Cap Co.
001324 Schneider Electric Ultra Terminal
001325 ImmenStar
001326 ECM Systems
001327 Data Acquisitions limited
001328 Westech Korea,
001329 Vsst Co.
00132A Strom Telecom, s. r. o.
00132B Phoenix Digital
00132C MAZ Brandenburg GmbH
00132D iWise Communications
00132E ITian Coporation
00132F Interactek
001330 Euro Protection Surveillance
001331 CellPoint Connect
001332 Beijing Topsec Network Security Technology Co.
001333 Baud Technology
001334 Arkados
001335 VS Industry Berhad
001336 Tianjin 712 Communication Broadcasting co.
001337 Orient Power Home Network
001338 Fresenius-vial
001339 El-me AG
00133A VadaTech
00133B Speed Dragon Multimedia Limited
00133C Quintron Systems
00133D Micro Memory
00133E MetaSwitch
00133F Eppendorf Instrumente GmbH
001340 AD.EL s.r.l.
001341 Shandong New Beiyang Information Technology Co.
001342 Vision Research
001343 Matsushita Electronic Components (Europe) GmbH
001344 Fargo Electronics
001345 Eaton
001346 D-Link
001347 BlueTree Wireless Data
001348 Artila Electronics Co.
001349 ZyXEL Communications
00134A Engim
00134B ToGoldenNet Technology
00134C YDT Technology International
00134D IPC systems
00134E Valox Systems
00134F Tranzeo Wireless Technologies
001350 Silver Spring Networks
001351 Niles Audio
001352 Naztec
001353 Hydac Filtertechnik Gmbh
001354 Zcomax Technologies
001355 Tomen Cyber-business Solutions
001356 target systemelectronic gmbh
001357 Soyal Technology Co.
001358 Realm Systems
001359 ProTelevision Technologies A/S
00135A Project T&E Limited
00135B PanelLink Cinema
00135C OnSite Systems
00135D Nttpc Communications
00135E Eab/rwi/k
00135F Cisco Systems
001360 Cisco Systems
001361 Biospace Co.
001362 ShinHeung Precision Co.
001363 Verascape
001364 Paradigm Technology.
001365 Nortel
001366 Neturity Technologies
001367 Narayon. Co.
001368 Maersk Data Defence
001369 Honda Electron Co.
00136A Hach Ultra Analytics
00136B E-tec
00136C Private
00136D Tentaculus AB
00136E Techmetro
00136F PacketMotion
001370 Nokia Danmark A/S
001371 Motorola CHS
001372 Dell
001373 BLwave Electronics Co.
001374 Attansic Technology
001375 American Security Products Co.
001376 Tabor Electronics
001377 Samsung Electronics CO.
001378 Qsan Technology
001379 Ponder Information Industries
00137A Netvox Technology Co.
00137B Movon
00137C Kaicom co.
00137D Dynalab
00137E CorEdge Networks
00137F Cisco Systems
001380 Cisco Systems
001381 Chips & Systems
001382 Cetacea Networks
001383 Application Technologies and Engineering Research Laboratory
001384 Advanced Motion Controls
001385 Add-On Technology Co.
001386 ABB/Totalflow
001387 27M Technologies AB
001388 WiMedia Alliance
001389 Redes de Telefona Mvil S.A.
00138A Qingdao Goertek Electronics Co.
00138B Phantom Technologies
00138C Kumyoung.Co.Ltd
00138D Kinghold
00138E Foab Elektronik AB
00138F Asiarock Incorporation
001390 Termtek Computer Co.
001391 Ouen Co.
001392 Video54 Technologies
001393 Panta Systems
001394 Infohand Co.
001395 congatec AG
001396 Acbel Polytech
001397 Xsigo Systems
001398 TrafficSim Co.
001399 Stac
00139A K-ubique ID
00139B ioIMAGE
00139C Exavera Technologies
00139D Design of Systems on Silicon S.A.
00139E Ciara Technologies
00139F Electronics Design Services, Co.
0013A0 Algosystem Co.
0013A1 Crow Electronic Engeneering
0013A2 MaxStream
0013A3 Siemens Com CPE Devices
0013A4 KeyEye Communications
0013A5 General Solutions
0013A6 Extricom
0013A7 Battelle Memorial Institute
0013A8 Tanisys Technology
0013A9 Sony
0013AA ALS  & TEC
0013AB Telemotive AG
0013AC Sunmyung Electronics Co.
0013AD Sendo
0013AE Radiance Technologies
0013AF Numa Technology
0013B0 Jablotron
0013B1 Intelligent Control Systems (Asia) Pte
0013B2 Carallon Limited
0013B3 Beijing Ecom Communications Technology Co.
0013B4 Appear TV
0013B5 Wavesat
0013B6 Sling Media
0013B7 Scantech ID
0013B8 RyCo Electronic Systems Limited
0013B9 BM SPA
0013BA ReadyLinks
0013BB Private
0013BC Artimi
0013BD Hymatom SA
0013BE Virtual Conexions
0013BF Media System Planning
0013C0 Trix Tecnologia Ltda.
0013C1 Asoka USA
0013C2 Wacom Co.
0013C3 Cisco Systems
0013C4 Cisco Systems
0013C5 Lightron Fiber-optic Devices
0013C6 OpenGear
0013C7 Ionos Co.
0013C8 Pirelli Broadband Solutions S.p.a.
0013C9 Beyond Achieve Enterprises
0013CA X-Digital Systems
0013CB Zenitel Norway AS
0013CC Tall Maple Systems
0013CD MTI co.
0013CE Intel Corporate
0013CF 4Access Communications
0013D0 e-San Limited
0013D1 Kirk Telecom A/S
0013D2 Page Iberica
0013D3 Micro-star International CO.
0013D4 Asustek Computer
0013D5 WiNetworks
0013D6 TII Network Technologies
0013D7 Spidcom Technologies SA
0013D8 Princeton Instruments
0013D9 Matrix Product Development
0013DA Diskware Co.
0013DB Shoei Electric Co.
0013DC Ibtek
0013DD Abbott Diagnostics
0013DE Adapt4
0013DF Ryvor
0013E0 Murata Manufacturing Co.
0013E1 Iprobe
0013E2 GeoVision
0013E3 CoVi Technologies
0013E4 Yangjae Systems
0013E5 Tenosys
0013E6 Technolution
0013E7 Minelab Electronics Limited
0013E8 Intel Corporate
0013E9 VeriWave
0013EA Kamstrup A/S
0013EB Sysmaster
0013EC Sunbay Software AG
0013ED Psia
0013EE JBX Designs
0013EF Kingjon Digital Technology Co.
0013F0 Wavefront Semiconductor
0013F1 Amod Technology Co.
0013F2 Klas
0013F3 Giga-byte Communications
0013F4 Psitek (Pty)
0013F5 Akimbi Systems
0013F6 Cintech
0013F7 SMC Networks
0013F8 Dex Security Solutions
0013F9 Cavera Systems
0013FA LifeSize Communications
0013FB RKC Instrument
0013FC SiCortex
0013FD Nokia Danmark A/S
0013FE Grandtec Electronic
0013FF Dage-MTI of MC
001400 Minerva Korea CO.
001401 Rivertree Networks
001402 kk-electronic a/s
001403 Renasis
001404 Motorola CHS
001405 OpenIB
001406 Go Networks
001407 Biosystems
001408 Eka Systems
001409 Magneti Marelli   S.E. S.p.a.
00140A Wepio Co.
00140B First International Computer
00140C GKB Cctv CO.
00140D Nortel
00140E Nortel
00140F Federal State Unitary Enterprise Leningrad R&D Institute of
001410 Suzhou Keda Technology CO.
001411 Deutschmann Automation GmbH & Co. KG
001412 S-TEC electronics AG
001413 Trebing & Himstedt Prozessautomation GmbH & Co. KG
001414 Jumpnode Systems
001415 Intec Automation
001416 Scosche Industries
001417 RSE Informations Technologie GmbH
001418 C4Line
001419 Sidsa
00141A Deicy
00141B Cisco Systems
00141C Cisco Systems
00141D Lust Antriebstechnik GmbH
00141E P.A. Semi
00141F SunKwang Electronics Co.
001420 G-Links networking company
001421 Total Wireless Technologies Pte.
001422 Dell
001423 J-S Co. Neurocom
001424 Merry Electrics CO.
001425 Galactic Computing
001426 NL Technology
001427 JazzMutant
001428 Vocollect
001429 V Center Technologies Co.
00142A Elitegroup Computer System Co.
00142B Edata Technologies
00142C Koncept International
00142D Toradex AG
00142E 77 Elektronika Kft.
00142F WildPackets
001430 ViPowER
001431 PDL Electronics
001432 Tarallax Wireless
001433 Empower Technologies(Canada)
001434 Keri Systems
001435 CityCom
001436 Qwerty Elektronik AB
001437 GSTeletech Co.
001438 Hewlett Packard
001439 Blonder Tongue Laboratories
00143A Raytalk International SRL
00143B Sensovation AG
00143C Oerlikon Contraves
00143D Aevoe
00143E AirLink Communications
00143F Hotway Technology
001440 Atomic
001441 Innovation Sound Technology Co.
001442 Atto
001443 Consultronics Europe
001444 Grundfos Electronics
001445 Telefon-Gradnja d.o.o.
001446 KidMapper
001447 Boaz
001448 Inventec Multimedia & Telecom
001449 Sichuan Changhong Electric
00144A Taiwan Thick-Film Ind.
00144B Hifn
00144C General Meters
00144D Intelligent Systems
00144E Srisa
00144F Sun Microsystems
001450 Heim Systems GmbH
001451 Apple Computer
001452 Calculex
001453 Advantech Technologies Co.
001454 Symwave
001455 Coder Electronics
001456 Edge Products
001457 T-vips AS
001458 HS Automatic ApS
001459 Moram Co.
00145A Elektrobit AG
00145B SeekerNet
00145C Intronics B.V.
00145D WJ Communications
00145E IBM
00145F Aditec CO.
001460 Kyocera Wireless
001461 Corona
001462 Digiwell Technology
001463 Idcs N.V.
001464 Cryptosoft
001465 Novo Nordisk A/S
001466 Kleinhenz Elektronik GmbH
001467 ArrowSpan
001468 CelPlan International
001469 Cisco Systems
00146A Cisco Systems
00146B Anagran
00146C Netgear
00146D RF Technologies
00146E H. Stoll GmbH & Co. KG
00146F Kohler Co
001470 Prokom Software SA
001471 Eastern Asia Technology Limited
001472 China Broadband Wireless IP Standard Group
001473 Bookham
001474 K40 Electronics
001475 Wiline Networks
001476 MultiCom Industries Limited
001477 Nertec 
001478 Shenzhen Tp-link Technologies Co.
001479 NEC Magnus Communications
00147A Eubus GmbH
00147B Iteris
00147C 3Com Europe
00147D Aeon Digital International
00147E PanGo Networks
00147F Thomson Telecom Belgium
001480 Hitachi-LG Data Storage Korea
001481 Multilink
001482 GoBackTV
001483 eXS
001484 Cermate Technologies
001485 Giga-Byte
001486 Echo Digital Audio
001487 American Technology Integrators
001488 Akorri Networks
001489 B15402100 - Jandei
00148A Elin Ebg Traction Gmbh
00148B Globo Electronic GmbH & Co. KG
00148C Fortress Technologies
00148D Cubic Defense Simulation Systems
00148E Tele Power
00148F Protronic (Far East)
001490 ASP
001491 Daniels Electronics
001492 Liteon, Mobile Media Solution SBU
001493 Systimax Solutions
001494 ESU AG
001495 2Wire
001496 Phonic
001497 Zhiyuan Eletronics Co.
001498 Viking Design Technology
001499 Helicomm
00149A Motorola Mobile Devices Business
00149B Nokota Communications
00149C HF Company
00149D Sound ID
00149E UbONE Co.
00149F System and Chips
0014A0 Rfid Asset Track
0014A1 Synchronous Communication
0014A2 Core Micro Systems
0014A3 Vitelec BV
0014A4 Hon Hai Precision Ind. Co.
0014A5 Gemtek Technology Co.
0014A6 Teranetics
0014A7 Nokia Danmark A/S
0014A8 Cisco Systems
0014A9 Cisco Systems
0014AA Ashly Audio
0014AB Senhai Electronic Technology Co.
0014AC Bountiful WiFi
0014AD Gassner Wiege- u. Metechnik GmbH
0014AE Wizlogics Co.
0014AF Datasym
0014B0 Naeil Community
0014B1 Avitec AB
0014B2 mCubelogics
0014B3 CoreStar International
0014B4 General Dynamics United Kingdom
0014B5 Private
0014B6 Enswer Technology
0014B7 AR Infotek
0014B8 Hill-Rom
0014B9 Stepmind
0014BA Carvers SA de CV
0014BB Open Interface North America
0014BC Synectic Telecom Exports PVT.
0014BD incNETWORKS
0014BE Wink communication technologyLTD
0014BF Cisco-Linksys
0014C0 Symstream Technology Group
0014C1 U.S. Robotics
0014C2 Hewlett Packard
0014C3 Seagate Technology
0014C4 Vitelcom Mobile Technology
0014C5 Alive Technologies
0014C6 Quixant
0014C7 Nortel
0014C8 Contemporary Research
0014C9 Silverback Systems
0014CA Key Radio Systems Limited
0014CB GMP|Wireless Medicine
0014CC Zetec
0014CD DigitalZone Co.
0014CE NF
0014CF Nextlink.to A/S
0014D0 BTI Photonics
0014D1 Trendware International
0014D2 Kyuki
0014D3 Sepsa
0014D4 K Technology
0014D5 Datang Telecom Technology CO. , LCD,Optical Communication Br
0014D6 Jeongmin Electronics Co.
0014D7 DataStor Technology
0014D8 bio-logic SA
0014D9 IP Fabrics
0014DA Sonicaid
0014DB Elma Trenew Electronic GmbH
0014DC Communication System Design & Manufacturing (csdm)
0014DD Covergence
0014DE Sage Instruments
0014DF HI-P Tech
0014E0 LET'S
0014E1 Data Display AG
0014E2 datacom systems
0014E3 mm-lab GmbH
0014E4 Integral Technologies
0014E5 Alticast
0014E6 AIM Infrarotmodule GmbH
0014E7 Stolinx
0014E8 Motorola CHS
0014E9 Nortech International
0014EA S Digm (Safe Paradigm)
0014EB AwarePoint
0014EC Acro Telecom
0014ED Airak
0014EE Western Digital Technologies
0014EF TZero Technologies
0014F0 Business Security OL AB
0014F1 Cisco Systems
0014F2 Cisco Systems
0014F3 ViXS Systems
0014F4 DekTec Digital Video B.V.
0014F5 OSI Security Devices
0014F6 Juniper Networks
0014F7 Crevis
0014F8 Scientific Atlanta
0014F9 Vantage Controls
0014FA AsGa S.A.
0014FB Technical Solutions
0014FC Extandon
0014FD Thecus Technology
0014FE Artech Electronics
0014FF Precise Automation
001500 Intel Corporate
001501 LexBox
001502 Beta Tech
001503 Proficomms S.r.o.
001504 Game Plus CO.
001505 Actiontec Electronics
001506 BeamExpress
001507 Renaissance Learning
001508 Global Target Enterprise
001509 Plus Technology Co.
00150A Sonoa Systems
00150B Sage Infotech
00150C AVM GmbH
00150D Hoana Medical
00150E Openbrain Technologies CO.
00150F mingjong
001510 Techsphere Co.
001511 Data Center Systems
001512 Zurich University of Applied Sciences
001513 EFS sas
001514 Hu Zhou Nava Networks&electronics
001515 Leipold+Co.GmbH
001516 Uriel Systems
001517 Intel Corporate
001518 Shenzhen 10MOONS Technology Development CO.
001519 StoreAge Networking Technologies
00151A Hunter Engineering Company
00151B Isilon Systems
00151C Leneco
00151D M2I
00151E Metaware Co.
00151F Multivision Intelligent Surveillance (Hong Kong)
001520 Radiocrafts AS
001521 Horoquartz
001522 Dea Security
001523 Meteor Communications
001524 Numatics
001525 PTI Integrated Systems
001526 Remote Technologies
001527 Balboa Instruments
001528 Beacon Medical Products d.b.a. BeaconMedaes
001529 N3
00152A Nokia GmbH
00152B Cisco Systems
00152C Cisco Systems
00152D TenX Networks
00152E PacketHop
00152F Motorola CHS
001530 Bus-Tech
001531 Kocom
001532 Consumer Technologies Group
001533 Nadam.co.
001534 A Beltrnica, Companhia de Comunicaes
001535 OTE Spa
001536 Powertech co.
001537 Ventus Networks
001538 RFID
001539 Technodrive SRL
00153A Shenzhen Syscan Technology Co.
00153B EMH Elektrizittszhler GmbH & CoKG
00153C Kprotech Co.
00153D Elim Product CO.
00153E Q-Matic Sweden AB
00153F Alenia Spazio S.p.A.
001540 Nortel
001541 StrataLight Communications
001542 Microhard S.r.l.
001543 Aberdeen Test Center
001544 coM.s.a.t. AG
001545 Seecode Co.
001546 ITG Worldwide Sdn Bhd
001547 AiZen Solutions
001548 Cube Technologies
001549 Dixtal Biomedica Ind. Com. Ltda
00154A Wanshih Electronic CO.
00154B Wonde Proud Technology Co.
00154C Saunders Electronics
00154D Netronome Systems
00154E Hirschmann Automation and Control GmbH
00154F one RF Technology
001550 Nits Technology
001551 RadioPulse
001552 Wi-Gear
001553 Cytyc
001554 Atalum Wireless S.A.
001555 DFM GmbH
001556 Sagem SA
001557 Olivetti
001558 Foxconn
001559 Securaplane Technologies
00155A Dainippon Pharmaceutical CO.
00155B Sampo
00155C Dresser Wayne
00155D Microsoft
00155E Morgan Stanley
00155F Ubiwave
001560 Hewlett Packard
001561 JJPlus
001562 Cisco Systems
001563 Cisco Systems
001564 Behringer Spezielle Studiotechnik Gmbh
001565 Xiamen Yealink Network Technology Co.
001566 A-First Technology Co.
001567 Radwin
001568 Dilithium Networks
001569 Peco II
00156A DG2L Technologies Pvt.
00156B Perfisans Networks
00156C Sane System CO.
00156D Ubiquiti Networks
00156E A. W. Communication Systems
00156F Xiranet Communications GmbH
001570 Symbol Technologies
001571 Nolan Systems
001572 Red-Lemon
001573 NewSoft  Technology
001574 Horizon Semiconductors
001575 Nevis Networks
001576 scil animal care company GmbH
001577 Allied Telesyn
001578 Audio / Video Innovations
001579 Lunatone Industrielle Elektronik GmbH
00157A Telefin S.p.A.
00157B Leuze electronic GmbH + Co. KG
00157C Dave Networks
00157D Posdata CO.
00157E Heyfra Electronic Gmbh
00157F ChuanG International Holding CO.
001580 U-way
001581 Makus
001582 TVonics
001583 IVT
001584 Schenck Process GmbH
001585 Aonvision Technolopy
001586 Xiamen Overseas Chinese Electronic Co.
001587 Takenaka Seisakusho Co.
001588 Balda-Thong Fook Solutions Sdn. Bhd.
001589 D-MAX Technology Co.
00158A Surecom Technology
00158B Park Air Systems
00158C Liab ApS
00158D Jennic
00158E Plustek.INC
00158F NTT Advanced Technology
001590 Hectronic GmbH
001591 RLW
001592 Facom UK (Melksham)
001593 U4EA Technologies
001594 Bixolon Co.
001595 Quester Tangent
001596 Arris International
001597 Aeta Audio Systems
001598 Kolektor group
001599 Samsung Electronics Co.
00159A Motorola CHS
00159B Nortel
00159C B-kyung System Co.
00159D Minicom Advanced Systems
00159E Saitek plc
00159F Terascala
0015A0 Nokia Danmark A/S
0015A1 Sinters SAS
0015A2 Arris International
0015A3 Arris International
0015A4 Arris International
0015A5 DCI Co.
0015A6 Digital Electronics Products
0015A7 Robatech AG
0015A8 Motorola Mobile Devices
0015A9 Kwang WOO I&C Co.
0015AA Rextechnik International Co.,
0015AB PRO CO Sound
0015AC Capelon AB
0015AD Accedian Networks
0015AE kyung il
0015AF Private
0015B0 Autotelenet Co.
0015B1 Ambient
0015B2 Advanced Industrial Computer
0015B3 Caretech AB
0015B4 Polymap  Wireless
0015B5 CI Network
0015B6 ShinMaywa Industries
0015B7 Toshiba
0015B8 Tahoe
0015B9 Samsung Electronics Co.
0015BA iba AG
0015BB SMA Technologie AG
0015BC Develco
0015BD Group 4 Technology
0015BE Iqua
0015BF technicob
0015C0 Digital Telemedia Co.
0015C1 Sony Computer Entertainment,
0015C2 3M Germany
0015C3 Ruf Telematik AG
0015C4 Flovel CO.
0015C5 Dell
0015C6 Cisco Systems
0015C7 Cisco Systems
0015C8 FlexiPanel
0015C9 Gumstix
0015CA TeraRecon
0015CB Surf Communication Solutions
0015CC Tepco Uquest
0015CD Exartech International
0015CE Arris International
0015CF Arris International
0015D0 Arris International
0015D1 Arris International
0015D2 Xantech
0015D3 Pantech&Curitel Communications
0015D4 Emitor AB
0015D5 Nicevt
0015D6 OSLiNK Sp. z o.o.
0015D7 Reti
0015D8 Interlink Electronics
0015D9 PKC Electronics Oy
0015DA Iritel A.D.
0015DB Canesta
0015DC KT&C Co.
0015DD IP Control Systems
0015DE Nokia Danmark A/S
0015DF Clivet S.p.A.
0015E0 Ericsson Mobile Platforms
0015E1 picoChip Designs
0015E2 Wissenschaftliche Geraetebau Dr. Ing. H. Knauer GmbH
0015E3 Dream Technologies
0015E4 Zimmer Elektromedizin
0015E5 Cheertek
0015E6 Mobile Technika
0015E7 Quantec ProAudio
0015E8 Nortel
0015E9 D-Link
0015EA Tellumat (Pty)
0015EB ZTE
0015EC Boca Devices
0015ED Fulcrum Microsystems
0015EE Omnex Control Systems
0015EF NEC Tokin
0015F0 EGO BV
0015F1 Kylink Communications
0015F2 Asustek Computer
0015F3 Peltor AB
0015F4 Eventide
0015F5 Sustainable Energy Systems
0015F6 Science AND Engineering Services
0015F7 Wintecronics
0015F8 Kingtronics Industrial Co.
0015F9 Cisco Systems
0015FA Cisco Systems
0015FB setex schermuly textile computer gmbh
0015FC Startco Engineering
0015FD Complete Media Systems
0015FE Schilling Robotics
0015FF Novatel Wireless
001600 CelleBrite Mobile Synchronization
001601 Buffalo
001602 Ceyon Technology Co.
001603 Private
001604 Sigpro
001605 Yorkville Sound
001606 Ideal Industries
001607 Curves International
001608 Sequans Communications
001609 Unitech electronics co.
00160A Sweex Europe BV
00160B TVWorks
00160C LPL  Development S.A. DE C.V
00160D Be Here
00160E Optica Technologies
00160F Badger Meter
001610 Carina Technology
001611 Altecon Srl
001612 Otsuka Electronics Co.
001613 LibreStream Technologies
001614 Picosecond Pulse Labs
001615 Nittan Company, Limited
001616 Browan Communication
001617 MSI
001618 Hivion Co.
001619 La Factora de Comunicaciones Aplicadas
00161A Dametric AB
00161B Micronet
00161C e:cue
00161D Innovative Wireless Technologies
00161E Woojinnet
00161F Sunwavetec Co.
001620 Sony Ericsson Mobile Communications AB
001621 Colorado Vnet
001622 BBH Systems Gmbh
001623 Interval Media
001624 Private
001625 Impinj
001626 Motorola CHS
001627 Embedded-logic Design AND More Gmbh
001628 Ultra Electronics Manufacturing and Card Systems
001629 Nivus GmbH
00162A Antik computers & communications s.r.o.
00162B Togami Electric Mfg.co.
00162C Xanboo
00162D STNet Co.
00162E Space Shuttle Hi-Tech Co.
00162F Geutebrck GmbH
001630 Vativ Technologies
001631 Xteam
001632 Samsung Electronics CO.
001633 Oxford Diagnostics
001634 Mathtech
001635 Hewlett Packard
001636 Quanta Computer
001637 Citel Srl
001638 Tecom Co.
001639 Ubiquam Co.
00163A Yves Technology CO.
00163B VertexRSI/General Dynamics
00163C Rebox B.V.
00163D Tsinghua Tongfang Legend Silicon Tech. Co.
00163E Xensource
00163F Crete Systems
001640 Asmobile Communication
001641 USI
001642 Pangolin
001643 Sunhillo Corproation
001644 Lite-on Technology
001645 Power Distribution
001646 Cisco Systems
001647 Cisco Systems
001648 SSD Company Limited
001649 SetOne GmbH
00164A Vibration Technology Limited
00164B Quorion Data Systems GmbH
00164C Planet INT Co.
00164D Alcatel North America IP Division
00164E Nokia Danmark A/S
00164F World Ethnic Broadcastin
001650 Eyal Microwave
001651 Private
001652 Hoatech Technologies
001653 Lego System A/S IE Electronics Division
001654 Flex-P Industries Sdn. Bhd.
001655 Fuho Technology Co.
001656 Nintendo Co.
001657 Aegate
001658 Fusiontech Technologies
001659 Z.m.p. Radwag
00165A Harman Specialty Group
00165B Grip Audio
00165C Trackflow
00165D AirDefense
00165E Precision I/O
00165F Fairmount Automation
001660 Nortel
001661 Novatium Solutions (P)
001662 Liyuh Technology
001663 KBT Mobile
001664 Prod-El SpA
001665 Cellon France
001666 Quantier Communication
001667 A-TEC Subsystem
001668 Eishin Electronics
001669 MRV Communication (Networks)
00166A TPS
00166B Samsung Electronics
00166C Samsung Electonics Digital Video System Division
00166D Yulong Computer Telecommunication Scientific(shenzhen)Co.
00166E Arbitron
00166F Intel
001670 Sknet
001671 Symphox Information Co.
001672 Zenway enterprise
001673 Private
001674 EuroCB (Phils.)
001675 Motorola MDb
001676 Intel
001677 Bihl+Wiedemann GmbH
001678 Shenzhen Baoan Gaoke Electronics CO.
001679 eOn Communications
00167A Skyworth Overseas Dvelopment
00167B Haver&Boecker
00167C iRex Technologies BV
00167D Sky-Line
00167E Diboss.co.
00167F Bluebird Soft
001680 Bally Gaming + Systems
001681 Vector Informatik GmbH
001682 Pro Dex
001683 Webio International Co.
001684 Donjin Co.
001685 Frwd Technologies
001686 Karl Storz Imaging
001687 Chubb CSC-Vendor AP
001688 ServerEngines
001689 Pilkor Electronics Co.
00168A id-Confirm
00168B Paralan
00168C DSL Partner AS
00168D Korwin CO.
00168E Vimicro
00168F GN Netcom as
001690 J-tek Incorporation
001691 Moser-Baer AG
001692 Scientific-Atlanta
001693 PowerLink Technology
001694 Sennheiser Communications A/S
001695 AVC Technology Limited
001696 QDI Technology (H.K.) Limited
001697 NEC
001698 T&A Mobile Phones SAS
001699 Private
00169A Quadrics
00169B Alstom Transport
00169C Cisco Systems
00169D Cisco Systems
00169E TV One
00169F Vimtron Electronics Co.
0016A0 Auto-Maskin
0016A1 3Leaf Networks
0016A2 CentraLite Systems
0016A3 Team Arteche
0016A4 Ezurio
0016A5 Tandberg Storage ASA
0016A6 Dovado FZ-LLC
0016A7 Aweta G&P
0016A8 CWT CO.
0016A9 2EI
0016AA Kei Communication Technology
0016AB PBI-Dansensor A/S
0016AC Toho Technology
0016AD BT-Links Company Limited
0016AE Inventel
0016AF Shenzhen Union Networks Equipment Co.
0016B0 VK
0016B1 KBS
0016B2 DriveCam
0016B3 Photonicbridges (China) Co.
0016B4 Private
0016B5 Motorola CHS
0016B6 Cisco-Linksys
0016B7 Seoul Commtech
0016B8 Sony Ericsson Mobile Communications
0016B9 ProCurve Networking
0016BA Weathernews
0016BB Law-Chain Computer Technology Co
0016BC Nokia Danmark A/S
0016BD ATI Industrial Automation
0016BE Infranet
0016BF PaloDEx Group Oy
0016C0 Semtech
0016C1 Eleksen
0016C2 Avtec Systems
0016C3 BA Systems
0016C4 SiRF Technology
0016C5 Shenzhen Xing Feng Industry Co.
0016C6 North Atlantic Industries
0016C7 Cisco Systems
0016C8 Cisco Systems
0016C9 NAT Seattle
0016CA Nortel
0016CB Apple Computer
0016CC Xcute Mobile
0016CD Hiji High-tech CO.
0016CE Hon Hai Precision Ind. Co.
0016CF Hon Hai Precision Ind. Co.
0016D0 ATech elektronika d.o.o.
0016D1 ZAT a.s.
0016D2 Caspian
0016D3 Wistron
0016D4 Compal Communications
0016D5 Synccom Co.
0016D6 TDA Tech
0016D7 Sunways AG
0016D8 Senea AB
0016D9 Ningbo Bird Co.
0016DA Futronic Technology Co.
0016DB Samsung Electronics Co.
0016DC Archos
0016DD Gigabeam
0016DE Fast
0016DF Lundinova AB
0016E0 3Com Europe
0016E1 SiliconStor
0016E2 American Fibertek
0016E3 Askey Computer
0016E4 Vanguard Security Engineering
0016E5 Fordley Development Limited
0016E6 Giga-byte Technology Co.
0016E7 Dynamix Promotions Limited
0016E8 Sigma Designs
0016E9 Tiba Medical
0016EA Intel
0016EB Intel
0016EC Elitegroup Computer Systems Co.
0016ED Integrian
0016EE RoyalDigital
0016EF Koko Fitness
0016F0 Zermatt Systems
0016F1 OmniSense
0016F2 Dmobile System Co.
0016F3 Cast Information Co.
0016F4 Eidicom Co.
0016F5 Dalian Golden Hualu Digital Technology Co.
0016F6 Video Products Group
0016F7 L-3 Communications, Electrodynamics
0016F8 Private
0016F9 Cetrta POT, D.o.o.
0016FA ECI Telecom
0016FB Shenzhen MTC Co.
0016FC Tohken Co.
0016FD Jaty Electronics
0016FE Alps Electric Co.
0016FF Wamin Optocomm Mfg
001700 Motorola MDb
001701 KDE
001702 Osung Midicom Co.
001703 Mosdan Internation Co.
001704 Shinco Electronics Group Co.
001705 Methode Electronics
001706 Techfaithwireless Communication Technology Limited.
001707 InGrid
001708 Hewlett Packard
001709 Exalt Communications
00170A Inew Digital Company
00170B Contela
00170C Benefon Oyj
00170D Dust Networks
00170E Cisco Systems
00170F Cisco Systems
001710 Casa Systems
001711 GE Healthcare Bio-Sciences AB
001712 Isco International
001713 Tiger NetCom
001714 BR Controls Nederland bv
001715 Qstik
001716 Qno Technology
001717 Leica Geosystems AG
001718 Vansco Electronics Oy
001719 AudioCodes USA
00171A Winegard Company
00171B Innovation Lab
00171C NT MicroSystems
00171D Digit
00171E Theo Benning GmbH & Co. KG
00171F IMV
001720 Image Sensing Systems
001721 Fitre S.p.a.
001722 Hanazeder Electronic GmbH
001723 Summit Data Communications
001724 Studer Professional Audio GmbH
001725 Liquid Computing
001726 m2c Electronic Technology
001727 Thermo Ramsey Italia s.r.l.
001728 Selex Communications
001729 UbicodLTD
00172A Proware Technology
00172B Global Technologies
00172C Taejin Infotech
00172D Axcen Photonics
00172E FXC
00172F NeuLion Incorporated
001730 Automation Electronics
001731 Asustek Computer
001732 Science-technical Center "rissa"
001733 neuf cegetel
001734 LGC Wireless
001735 Private
001736 iiTron
001737 Industrie Dial Face S.p.A.
001738 XIV
001739 Bright Headphone Electronics Company
00173A Edge Integration Systems
00173B Arched Rock
00173C Extreme Engineering Solutions
00173D Neology
00173E LeucotronEquipamentos Ltda.
00173F Belkin
001740 Technologies Labtronix
001741 Defidev
001742 Fujitsu Limited
001743 Private
001744 Araneo
001745 Innotz CO.
001746 Freedom9
001747 Trimble
001748 Neokoros Brasil Ltda
001749 Hyundae Yong-o-sa Co.
00174A Socomec
00174B Nokia Danmark A/S
00174C Millipore
00174D Dynamic Network Factory
00174E Parama-tech Co.
00174F iCatch
001750 GSI Group, MicroE Systems
001751 Online
001752 DAGS
001753 nFore Technology
001754 Arkino
001755 GE Security
001756 Vinci Labs Oy
001757 RIX Technology Limited
001758 ThruVision
001759 Cisco Systems
00175A Cisco Systems
00175B ACS Solutions Switzerland
00175C Sharp
00175D Dongseo system.
00175E Anta Systems
00175F Xenolink Communications Co.
001760 Naito Densei Machida MFG.CO.
001761 ZKSoftware
001762 Solar Technology
001763 Essentia S.p.A.
001764 ATMedia GmbH
001765 Nortel
001766 Accense Technology
001767 Earforce AS
001768 Zinwave
001769 Cymphonix
00176A Avago Technologies
00176B Kiyon
00176C Pivot3
00176D Core
00176E Ducati Sistemi
00176F PAX Computer Technology(Shenzhen)
001770 Arti Industrial Electronics
001771 APD Communications
001772 Astro Strobel Kommunikationssysteme Gmbh
001773 Laketune Technologies Co.
001774 Elesta GmbH
001775 TTE Germany GmbH
001776 Meso Scale Diagnostics
001777 Obsidian Research
001778 Central Music Co.
001779 QuickTel
00177A Assa Abloy AB
00177B Azalea Networks
00177C D-Link India
00177D IDT International Limited
00177E Meshcom Technologies
00177F Worldsmart Retech
001780 Applera Holding B.V. Singapore Operations
001781 Greystone Data System
001782 LoBenn
001783 Texas Instruments
001784 Motorola Mobile Devices
001785 Sparr Electronics
001786 wisembed
001787 Brother, Brother & Sons ApS
001788 Philips Lighting BV
001789 Zenitron
00178A Darts Technologies
00178B Teledyne Technologies Incorporated
00178C Independent Witness
00178D Checkpoint Systems
00178E Gunnebo Cash Automation AB
00178F Ningbo Yidong Electronic Co.
001790 Hyundai Digitech Co
001791 LinTech GmbH
001792 Falcom Wireless Comunications Gmbh
001793 Tigi
001794 Cisco Systems
001795 Cisco Systems
001796 Rittmeyer AG
001797 Telsy Elettronica S.p.A.
001798 Azonic Technology Co.
001799 SmarTire Systems
00179A D-Link
00179B Chant Sincere CO.
00179C Deprag Schulz Gmbh u. CO.
00179D Kelman Limited
00179E Samsys Technologies
00179F Apricorn
0017A0 RoboTech srl
0017A1 3soft
0017A2 Camrivox
0017A3 MIX s.r.l.
0017A4 Global Data Services
0017A5 TrendChip Technologies
0017A6 Yosin Electronics CO.
0017A7 Mobile Computing Promotion Consortium
0017A8 EDM
0017A9 Sentivision
0017AA elab-experience
0017AB Nintendo Co.
0017AC O'Neil Product Development
0017AD AceNet
0017AE GAI-Tronics
0017AF Enermet
0017B0 Nokia Danmark A/S
0017B1 Acist Medical Systems
0017B2 SK Telesys
0017B3 Aftek Infosys Limited
0017B4 Remote Security Systems
0017B5 Peerless Systems
0017B6 Aquantia
0017B7 Tonze Technology Co.
0017B8 Novatron CO.
0017B9 Gambro Lundia AB
0017BA Sedo CO.
0017BB Syrinx Industrial Electronics
0017BC Touchtunes Music
0017BD Tibetsystem
0017BE Tratec Telecom B.V.
0017BF Coherent Research Limited
0017C0 PureTech Systems
0017C1 CM Precision Technology
0017C2 Pirelli Broadband Solutions
0017C3 KTF Technologies
0017C4 Quanta Microsystems
0017C5 SonicWALL
0017C6 Labcal Technologies
0017C7 Mara Systems Consulting AB
0017C8 Kyocera Mita
0017C9 Samsung Electronics Co.
0017CA BenQ
0017CB Juniper Networks
0017CC Alcatel USA Sourcing LP
0017CD CEC Wireless R&D
0017CE MB International Telecom Labs srl
0017CF iMCA-GmbH
0017D0 Opticom Communications
0017D1 Nortel
0017D2 Thinlinx
0017D3 Etymotic Research
0017D4 Monsoon Multimedia
0017D5 Samsung Electronics Co.
0017D6 Bluechips Microhouse Co.
0017D7 Input/Output
0017D8 Magnum Semiconductor
0017D9 AAI
0017DA Spans Logic
0017DB Private
0017DC Daemyung Zero1
0017DD Clipsal Australia
0017DE Advantage Six
0017DF Cisco Systems
0017E0 Cisco Systems
0017E1 Dacos Technologies Co.
0017E2 Motorola Mobile Devices
0017E3 Texas Instruments
0017E4 Texas Instruments
0017E5 Texas Instruments
0017E6 Texas Instruments
0017E7 Texas Instruments
0017E8 Texas Instruments
0017E9 Texas Instruments
0017EA Texas Instruments
0017EB Texas Instruments
0017EC Texas Instruments
0017ED WooJooIT
0017EE Motorola CHS
0017EF Blade Network Technologies
0017F0 Szcom Broadband Network Technology Co.
0017F1 Renu Electronics Pvt
0017F2 Apple Computer
0017F3 M/A-COM Wireless Systems
0017F4 Zeron Alliance
0017F5 Neoptek
0017F6 Pyramid Meriden
0017F7 CEM Solutions Pvt
0017F8 Motech Industries
0017F9 Forcom Sp. z o.o.
0017FA Microsoft
0017FB FA
0017FC Suprema
0017FD Amulet Hotkey
0017FE Talos System
0017FF Playline Co.
001800 Unigrand
001801 Actiontec Electronics
001802 Alpha Networks
001803 ArcSoft Shanghai Co.
001804 E-tek Digital Technology Limited
001805 Beijing InHand Networking
001806 Hokkei Industries Co.
001807 Fanstel
001808 SightLogix
001809 Cresyn
00180A Meraki Networks
00180B Brilliant Telecommunications
00180C Optelian Access Networks
00180D Terabytes Server Storage Tech
00180E Avega Systems
00180F Nokia Danmark A/S
001810 IPTrade S.A.
001811 Neuros Technology International
001812 Beijing Xinwei Telecom Technology Co.
001813 Sony Ericsson Mobile Communications
001814 Mitutoyo
001815 GZ Technologies
001816 Ubixon Co.
001817 D. E. Shaw Research
001818 Cisco Systems
001819 Cisco Systems
00181A AVerMedia Technologies
00181B TaiJin Metal Co.
00181C Exterity Limited
00181D Asia Electronics Co.
00181E GDX Technologies
00181F Palmmicro Communications
001820 w5networks
001821 Sindoricoh
001822 CEC Telecom Co.
001823 Delta Electronics
001824 Kimaldi Electronics
001825 Wavion
001826 Cale Access AB
001827 NEC Philips Unified Solutions Nederland BV
001828 e2v technologies (UK)
001829 Gatsometer
00182A Taiwan Video & Monitor
00182B Softier
00182C Ascend Networks
00182D Artec Group O
00182E Wireless Ventures USA
00182F Texas Instruments
001830 Texas Instruments
001831 Texas Instruments
001832 Texas Instruments
001833 Texas Instruments
001834 Texas Instruments
001835 ITC
001836 Reliance Electric Limited
001837 Universal Abit Co.
001838 PanAccess Communications
001839 Cisco-Linksys
00183A Westell Technologies
00183B Cenits Co.
00183C Encore Software Limited
00183D Vertex Link
00183E Digilent
00183F 2Wire
001840 3 Phoenix
001841 High Tech Computer
001842 Nokia Danmark A/S
001843 Dawevision
001844 Heads Up Technologies
001845 NPL Pulsar
001846 Crypto S.A.
001847 AceNet Technology
001848 Vcom
001849 Pigeon Point Systems
00184A Catcher
00184B Las Vegas Gaming
00184C Bogen Communications
00184D Netgear
00184E Lianhe Technologies
00184F 8 Ways Technology
001850 Secfone Kft
001851 SWsoft
001852 StorLink Semiconductors
001853 Atera Networks
001854 Airtube 
001855 Aeromaritime Systembau GmbH
001856 EyeFi
001857 Unilever R&D
001858 TagMaster AB
001859 Strawberry Linux Co.
00185A uControl
00185B Network Chemistry
00185C EDS Lab Pte
00185D Taiguen Technology (shen-zhen) CO.
00185E Nexterm
00185F TAC
001860 SIM Technology Group Shanghai Simcom,
001861 Ooma
001862 Seagate Technology
001863 Veritech Electronics Limited
001864 Cybectec
001865 Bayer Diagnostics Sudbury
001866 Leutron Vision
001867 Evolution Robotics Retail
001868 Scientific Atlanta, A Cisco Company
001869 Kingjim
00186A Global Link Digital Technology Co
00186B Sambu Communics CO.
00186C Neonode AB
00186D Zhenjiang Sapphire Electronic Industry CO.
00186E 3COM Europe
00186F Setha Industria Eletronica Ltda
001870 E28 Shanghai Limited
001871 Global Data Services
001872 Expertise Engineering
001873 Cisco Systems
001874 Cisco Systems
001875 AnaCise Testnology Pte
001876 WowWee
001877 Amplex A/S
001878 Mackware GmbH
001879 dSys
00187A Wiremold
00187B 4NSYS Co.
00187C Intercross
00187D Armorlink shanghai Co.
00187E RGB Spectrum
00187F Zodianet
001880 Mobilygen
001881 Buyang Electronics Industrial Co.
001C7C Perq Systems
002000 Lexmark International
002001 DSP Solutions
002002 Seritech Enterprise CO.
002003 Pixel Power
002004 Yamatake-honeywell CO.
002005 Simple Technology
002006 Garrett Communications
002007 SFA
002008 Cable & Computer Technology
002009 Packard Bell Elec.
00200A Source-comm
00200B Octagon Systems
00200C Adastra Systems
00200D Carl Zeiss
00200E Satellite Technology MGMT
00200F Tanbac CO.
002010 Jeol System Technology CO.
002011 Canopus CO.
002012 Camtronics Medical Systems
002013 Diversified Technology
002014 Global View CO.
002015 Actis Computer SA
002016 Showa Electric Wire & Cable CO
002017 Orbotech
002018 CIS Technology
002019 Ohler Gmbh
00201A MRV Communications
00201B Northern Telecom/network
00201C Excel
00201D Katana Products
00201E Netquest
00201F Best Power Technology
002020 Megatron Computer Industries
002021 Algorithms Software PVT.
002022 NMS Communications
002023 T.C. Technologies
002024 Pacific Communication Sciences
002025 Control Technology
002026 Amkly Systems
002027 Ming Fortune Industry CO.
002028 West EGG Systems
002029 Teleprocessing Products
00202A N.V. Dzine
00202B Advanced Telecommunications Modules
00202C Welltronix CO.
00202D Taiyo
00202E Daystar Digital
00202F Zeta Communications
002030 Analog & Digital Systems
002031 Ertec Gmbh
002032 Alcatel Taisel
002033 Synapse Technologies
002034 Rotec Industrieautomation Gmbh
002035 IBM
002036 BMC Software
002037 Seagate Technology
002038 VME Microsystems International
002039 Scinets
00203A Digital Bi0metrics
00203B Wisdm
00203C Eurotime AB
00203D Novar Electronics
00203E LogiCan Technologies
00203F Juki
002040 Motorola Broadband Communications Sector
002041 Data NET
002042 Datametrics
002043 Neuron Company Limited
002044 Genitech
002045 ION Networks
002046 Ciprico
002047 Steinbrecher
002048 Marconi Communications
002049 Comtron
00204A Pronet Gmbh
00204B Autocomputer CO.
00204C Mitron Computer PTE
00204D Inovis Gmbh
00204E Network Security Systems
00204F Deutsche Aerospace AG
002050 Korea Computer
002051 Verilink
002052 Ragula Systems
002053 Huntsville Microsystems
002054 Eastern Research
002055 Altech CO.
002056 Neoproducts
002057 Titze Datentechnik Gmbh
002058 Allied Signal
002059 Miro Computer Products AG
00205A Computer Identics
00205B Kentrox
00205C InterNet Systems of Florida
00205D Nanomatic OY
00205E Castle ROCK
00205F Gammadata Computer Gmbh
002060 Alcatel Italia S.p.a.
002061 Dynatech Communications
002062 Scorpion Logic
002063 Wipro Infotech
002064 Protec Microsystems
002065 Supernet Networking
002066 General Magic
002067 Private
002068 Isdyne
002069 Isdn Systems
00206A Osaka Computer
00206B Konica Minolta Holdings
00206C Evergreen Technology
00206D Data RACE
00206E XACT
00206F Flowpoint
002070 Hynet
002071 IBR Gmbh
002072 Worklink Innovations
002073 Fusion Systems
002074 Sungwoon Systems
002075 Motorola Communication Israel
002076 Reudo
002077 Kardios Systems
002078 Runtop
002079 Mikron Gmbh
00207A WiSE Communications
00207B Intel
00207C Autec Gmbh
00207D Advanced Computer Applications
00207E Finecom Co.
00207F Kyoei Sangyo CO.
002080 Synergy (uk)
002081 Titan Electronics
002082 Oneac
002083 Presticom Incorporated
002084 OCE Printing Systems
002085 Exide Electronics
002086 Microtech Electronics Limited
002087 Memotec Communications
002088 Global Village Communication
002089 T3plus Networking
00208A Sonix Communications
00208B Lapis Technologies
00208C Galaxy Networks
00208D CMD Technology
00208E Chevin Software ENG.
00208F ECI Telecom
002090 Advanced Compression Technology
002091 J125, National Security Agency
002092 Chess Engineering B.V.
002093 Landings Technology
002094 Cubix
002095 Riva Electronics
002096 Invensys
002097 Applied Signal Technology
002098 Hectronic AB
002099 BON Electric CO.
00209A THE 3DO Company
00209B Ersat Electronic Gmbh
00209C Primary Access
00209D Lippert Automationstechnik
00209E Brown's Operating System Services
00209F Mercury Computer Systems
0020A0 OA Laboratory CO.
0020A1 Dovatron
0020A2 Galcom Networking
0020A3 Divicom
0020A4 Multipoint Networks
0020A5 API Engineering
0020A6 Proxim
0020A7 Pairgain Technologies
0020A8 Sast Technology
0020A9 White Horse Industrial
0020AA Digimedia Vision
0020AB Micro Industries
0020AC Interflex Datensysteme Gmbh
0020AD Linq Systems
0020AE Ornet Data Communication TECH.
0020AF 3com
0020B0 Gateway Devices
0020B1 Comtech Research
0020B2 GKD Gesellschaft Fur Kommunikation Und Datentechnik
0020B3 Scltec Communications Systems
0020B4 Terma Elektronik AS
0020B5 Yaskawa Electric
0020B6 Agile Networks
0020B7 Namaqua Computerware
0020B8 Prime Option
0020B9 Metricom
0020BA Center FOR High Performance
0020BB ZAX
0020BC Long Reach Networks
0020BD Niobrara R &
0020BE LAN Access
0020BF Aehr Test Systems
0020C0 Pulse Electronics
0020C1 SAXA
0020C2 Texas Memory Systems
0020C3 Counter Solutions
0020C4 Inet
0020C5 Eagle Technology
0020C6 Nectec
0020C7 Akai Professional M.I.
0020C8 Larscom Incorporated
0020C9 Victron BV
0020CA Digital Ocean
0020CB Pretec Electronics
0020CC Digital Services
0020CD Hybrid Networks
0020CE Logical Design Group
0020CF Test & Measurement Systems
0020D0 Versalynx
0020D1 Microcomputer Systems (M) SDN.
0020D2 RAD Data Communications
0020D3 OST (ouest Standard Telematiqu
0020D4 Cabletron - Zeittnet
0020D5 Vipa Gmbh
0020D6 Breezecom
0020D7 Japan Minicomputer Systems CO.
0020D8 Nortel Networks
0020D9 Panasonic Technologies,/mieco-us
0020DA Alcatel North America ESD
0020DB Xnet Technology
0020DC Densitron Taiwan
0020DD Cybertec
0020DE Japan Digital Laborat'yltd
0020DF Kyosan Electric MFG. CO.
0020E0 Actiontec Electronics
0020E1 Alamar Electronics
0020E2 Information Resource Engineering
0020E3 MCD Kencom
0020E4 Hsing Tech Enterprise CO.
0020E5 Apex DATA
0020E6 Lidkoping Machine Tools AB
0020E7 B&W Nuclear Service Company
0020E8 Datatrek
0020E9 Dantel
0020EA Efficient Networks
0020EB Cincinnati Microwave
0020EC Techware Systems
0020ED Giga-byte Technology CO.
0020EE Gtech
0020EF USC
0020F0 Universal Microelectronics CO.
0020F1 Altos India Limited
0020F2 SUN Microsystems
0020F3 Raynet
0020F4 Spectrix
0020F5 Pandatel AG
0020F6 NET TEK  AND Karlnet
0020F7 Cyberdata
0020F8 Carrera Computers
0020F9 Paralink Networks
0020FA GDE Systems
0020FB Octel Communications
0020FC Matrox
0020FD ITV Technologies
0020FE Topware / Grand Computer
0020FF Symmetrical Technologies
002654 3Com
003000 Allwell Technology
003001 SMP
003002 Expand Networks
003003 Phasys
003004 Leadtek Research
003005 Fujitsu Siemens Computers
003006 Superpower Computer
003007 OPTI
003008 Avio Digital
003009 Tachion Networks
00300A Aztech Systems
00300B mPHASE Technologies
00300C Congruency
00300D MMC Technology
00300E Klotz Digital AG
00300F IMT - Information Management
003010 Visionetics International
003011 HMS Fieldbus Systems AB
003012 Digital Engineering
003013 NEC
003014 Divio
003015 CP Clare
003016 Ishida CO.
003017 BlueArc UK
003018 Jetway Information Co.
003019 Cisco Systems
00301A Smartbridges PTE.
00301B Shuttle
00301C Altvater Airdata Systems
00301D Skystream
00301E 3COM Europe
00301F Optical Networks
003020 TSI
003021 Hsing TECH. Enterprise Co.
003022 Fong Kai Industrial Co.
003023 Cogent Computer Systems
003024 Cisco Systems
003025 Checkout Computer Systems
003026 HeiTel Digital Video GmbH
003027 Kerbango
003028 Fase Saldatura srl
003029 Opicom
00302A Southern Information
00302B Inalp Networks
00302C Sylantro Systems
00302D Quantum Bridge Communications
00302E Hoft & Wessel AG
00302F Smiths Industries
003030 Harmonix
003031 Lightwave Communications
003032 MagicRam
003033 Orient Telecom CO.
003034 SET Engineering
003035 Corning Incorporated
003036 RMP Elektroniksysteme Gmbh
003037 Packard Bell Nec Services
003038 XCP
003039 Softbook Press
00303A Maatel
00303B PowerCom Technology
00303C Onnto
00303D IVA
00303E Radcom
00303F TurboComm Tech
003040 Cisco Systems
003041 Saejin T & M CO.
003042 DeTeWe-Deutsche Telephonwerke
003043 Idream Technologies, PTE.
003044 Portsmith
003045 Village Networks, (VNI)
003046 Controlled Electronic Manageme
003047 Nissei Electric CO.
003048 Supermicro Computer
003049 Bryant Technology
00304A Fraunhofer Ipms
00304B Orbacom Systems
00304C Appian Communications
00304D ESI
00304E Bustec Production
00304F Planet Technology
003050 Versa Technology
003051 Orbit Avionic & Communication
003052 Elastic Networks
003053 Basler AG
003054 Castlenet Technology
003055 Hitachi Semiconductor America,
003056 Beck IPC GmbH
003057 QTelNet
003058 API Motion
003059 Digital-logic AG
00305A Telgen
00305B Module Department
00305C Smar Laboratories
00305D Digitra Systems
00305E Abelko Innovation
00305F Imacon APS
003060 Powerfile
003061 MobyTEL
003062 Path 1 Network Technol's
003063 Santera Systems
003064 Adlink Technology
003065 Apple Computer
003066 Digital Wireless
003067 Biostar Microtech Int'l
003068 Cybernetics TECH. CO.
003069 Impacct Technology
00306A Penta Media CO.
00306B Cmos Systems
00306C Hitex Holding GmbH
00306D Lucent Technologies
00306E Hewlett Packard
00306F Seyeon TECH. CO.
003070 1Net
003071 Cisco Systems
003072 Intellibyte
003073 International Microsystems
003074 Equiinet
003075 Adtech
003076 Akamba
003077 Onprem Networks
003078 Cisco Systems
003079 CQOS
00307A Advanced Technology & Systems
00307B Cisco Systems
00307C Adid SA
00307D GRE America
00307E Redflex Communication Systems
00307F Irlan
003080 Cisco Systems
003081 Altos C&C
003082 Taihan Electric Wire CO.
003083 Ivron Systems
003084 Allied Telesyn Internaional
003085 Cisco Systems
003086 Transistor Devices
003087 Vega Grieshaber KG
003088 Siara Systems
003089 Spectrapoint Wireless
00308A Nicotra Sistemi S.P.A
00308B Brix Networks
00308C Advanced Digital Information
00308D Pinnacle Systems
00308E Cross Match Technologies
00308F Micrilor
003090 Cyra Technologies
003091 Taiwan First Line ELEC.
003092 ModuNORM GmbH
003093 Sonnet Technologies
003094 Cisco Systems
003095 Procomp Informatics
003096 Cisco Systems
003097 Exomatic AB
003098 Global Converging Technologies
003099 Boenig UND Kallenbach OHG
00309A Astro Terra
00309B Smartware
00309C Timing Applications
00309D Nimble Microsystems
00309E Workbit
00309F Amber Networks
0030A0 Tyco Submarine Systems
0030A1 Webgate
0030A2 Lightner Engineering
0030A3 Cisco Systems
0030A4 Woodwind Communications System
0030A5 Active Power
0030A6 Vianet Technologies
0030A7 Schweitzer Engineering
0030A8 Ol'e Communications
0030A9 Netiverse
0030AA Axus Microsystems
0030AB Delta Networks
0030AC Systeme Lauer GmbH & Co.
0030AD Shanghai Communication
0030AE Times N System
0030AF Honeywell GmbH
0030B0 Convergenet Technologies
0030B1 aXess-pro networks GmbH
0030B2 L-3 Sonoma EO
0030B3 San Valley Systems
0030B4 Intersil
0030B5 Tadiran Microwave Networks
0030B6 Cisco Systems
0030B7 Teletrol Systems
0030B8 RiverDelta Networks
0030B9 Ectel
0030BA Ac&t System CO.
0030BB CacheFlow
0030BC Optronic AG
0030BD Belkin Components
0030BE City-Net Technology
0030BF Multidata Gmbh
0030C0 Lara Technology
0030C1 Hewlett-packard
0030C2 Comone
0030C3 Flueckiger Elektronik AG
0030C4 Canon Imaging System Technologies
0030C5 Cadence Design Systems
0030C6 Control Solutions
0030C7 Macromate
0030C8 GAD LINE
0030C9 LuxN
0030CA Discovery Com
0030CB Omni Flow Computers
0030CC Tenor Networks
0030CD Conexant Systems
0030CE Zaffire
0030CF TWO Technologies
0030D0 Tellabs
0030D1 Inova
0030D2 WIN Technologies, CO.
0030D3 Agilent Technologies
0030D4 AAE Systems
0030D5 DResearch GmbH
0030D6 MSC Vertriebs Gmbh
0030D7 Innovative Systems, L.L.C.
0030D8 Sitek
0030D9 Datacore Software
0030DA Comtrend CO.
0030DB Mindready Solutions
0030DC Rightech
0030DD Indigita
0030DE Wago Kontakttechnik Gmbh
0030DF Kb/tel Telecomunicaciones
0030E0 Oxford Semiconductor
0030E1 Acrotron Systems
0030E2 Garnet Systems CO.
0030E3 Sedona Networks
0030E4 Chiyoda System Riken
0030E5 Amper Datos S.A.
0030E6 Siemens Medical Systems
0030E7 CNF Mobile Solutions
0030E8 Ensim
0030E9 GMA Communication Manufact'g
0030EA TeraForce Technology
0030EB Turbonet Communications
0030EC Borgardt
0030ED Expert Magnetics
0030EE DSG Technology
0030EF Neon Technology
0030F0 Uniform Industrial
0030F1 Accton Technology
0030F2 Cisco Systems
0030F3 At Work Computers
0030F4 Stardot Technologies
0030F5 Wild Lab.
0030F6 Securelogix
0030F7 Ramix
0030F8 Dynapro Systems
0030F9 Sollae Systems Co.
0030FA Telica
0030FB AZS Technology AG
0030FC Terawave Communications
0030FD Integrated Systems Design
0030FE DSA GmbH
0030FF Datafab Systems
004000 PCI Componentes DA Amzonia
004001 Zyxel Communications
004002 Perle Systems Limited
004003 Westinghouse Process Control
004004 ICM CO.
004005 ANI Communications
004006 Sampo Technology
004007 Telmat Informatique
004008 A Plus Info
004009 Tachibana Tectron CO.
00400A Pivotal Technologies
00400B Cisco Systems
00400C General Micro Systems
00400D Lannet Data Communications
00400E Memotec Communications
00400F Datacom Technologies
004010 Sonic Systems
004011 Andover Controls
004012 Windata
004013 NTT Data COMM. Systems
004014 Comsoft Gmbh
004015 Ascom Infrasys AG
004016 Hadax Electronics
004017 Silex Technology America
004018 Adobe Systems
004019 Aeon Systems
00401A Fuji Electric CO.
00401B Printer Systems
00401C AST Research
00401D Invisible Software
00401E ICC
00401F Colorgraph
004020 Pinacl Communication
004021 Raster Graphics
004022 Klever Computers
004023 Logic
004024 Compac
004025 Molecular Dynamics
004026 Melco
004027 SMC Massachusetts
004028 Netcomm Limited
004029 Compex
00402A Canoga-perkins
00402B Trigem Computer
00402C Isis Distributed Systems
00402D Harris Adacom
00402E Precision Software
00402F Xlnt Designs
004030 GK Computer
004031 Kokusai Electric CO.
004032 Digital Communications
004033 Addtron Technology CO.
004034 Bustek
004035 Opcom
004036 Tribe Computer Works
004037 Sea-ilan
004038 Talent Electric Incorporated
004039 Optec Daiichi Denko CO.
00403A Impact Technologies
00403B Synerjet International
00403C Forks
00403D Teradata
00403E Raster OPS
00403F Ssangyong Computer Systems
004040 Ring Access
004041 Fujikura
004042 N.a.t. Gmbh
004043 Nokia Telecommunications
004044 Qnix Computer CO.
004045 Twinhead
004046 UDC Research Limited
004047 Wind River Systems
004048 SMD Informatica S.A.
004049 Tegimenta AG
00404A West Australian Department
00404B Maple Computer Systems
00404C Hypertec
00404D Telecommunications Techniques
00404E Fluent
00404F Space & Naval Warfare Systems
004050 Ironics, Incorporated
004051 Gracilis
004052 Star Technologies
004053 Ampro Computers
004054 Connection Machines Services
004055 Metronix Gmbh
004056 MCM Japan
004057 Lockheed - Sanders
004058 Kronos
004059 Yoshida Kogyo K. K.
00405A Goldstar Information & COMM.
00405B Funasset Limited
00405C Future Systems
00405D Star-tek
00405E North Hills Israel
00405F AFE Computers
004060 Comendec
004061 Datatech Enterprises CO.
004062 E-systems,/garland DIV.
004063 VIA Technologies
004064 KLA Instruments
004065 GTE Spacenet
004066 Hitachi Cable
004067 Omnibyte
004068 Extended Systems
004069 Lemcom Systems
00406A Kentek Information Systems
00406B Sysgen
00406C Copernique
00406D Lanco
00406E Corollary
00406F Sync Research
004070 Interware CO.
004071 ATM Computer Gmbh
004072 Applied Innovation
004073 Bass Associates
004074 Cable AND Wireless
004075 M-trade (uk)
004076 Sun Conversion Technologies
004077 Maxton Technology
004078 Wearnes Automation PTE
004079 Juko Manufacture Company
00407A Societe D'exploitation DU Cnit
00407B Scientific Atlanta
00407C Qume
00407D Extension Technology
00407E Evergreen Systems
00407F Flir Systems
004080 Athenix
004081 Mannesmann Scangraphic Gmbh
004082 Laboratory Equipment
004083 TDA Industria DE Produtos
004084 Honeywell
004085 Saab Instruments AB
004086 Michels & Kleberhoff Computer
004087 Ubitrex
004088 Mobius Technologies
004089 Meidensha
00408A TPS Teleprocessing SYS. Gmbh
00408B Raylan
00408C Axis Communications AB
00408D THE Goodyear Tire & Rubber CO.
00408E Digilog
00408F Wm-data Minfo AB
004090 Ansel Communications
004091 Procomp Industria Eletronica
004092 ASP Computer Products
004093 Paxdata Networks
004094 Shographics
004095 R.p.t. Intergroups Int'l
004096 Cisco Systems
004097 Datex Division OF
004098 Dressler Gmbh & CO.
004099 Newgen Systems
00409A Network Express
00409B HAL Computer Systems
00409C Transware
00409D Digiboard
00409E Concurrent Technologies 
00409F Lancast/casat Technology
0040A0 Goldstar CO.
0040A1 Ergo Computing
0040A2 Kingstar Technology
0040A3 Microunity Systems Engineering
0040A4 Rose Electronics
0040A5 Clinicomp INTL.
0040A6 Cray
0040A7 Itautec Philco S.A.
0040A8 IMF International
0040A9 Datacom
0040AA Valmet Automation
0040AB Roland DG
0040AC Super Workstation
0040AD SMA Regelsysteme Gmbh
0040AE Delta Controls
0040AF Digital Products
0040B0 Bytex, Engineering
0040B1 Codonics
0040B2 Systemforschung
0040B3 PAR Microsystems
0040B4 Nextcom K.K.
0040B5 Video Technology Computers
0040B6 Computerm 
0040B7 Stealth Computer Systems
0040B8 Idea Associates
0040B9 Macq Electronique SA
0040BA Alliant Computer Systems
0040BB Goldstar Cable CO.
0040BC Algorithmics
0040BD Starlight Networks
0040BE Boeing Defense & Space
0040BF Channel Systems Intern'l
0040C0 Vista Controls
0040C1 Bizerba-werke Wilheim Kraut
0040C2 Applied Computing Devices
0040C3 Fischer AND Porter CO.
0040C4 Kinkei System
0040C5 Micom Communications
0040C6 Fibernet Research
0040C7 Ruby Tech
0040C8 Milan Technology
0040C9 Ncube
0040CA First Internat'l Computer
0040CB Lanwan Technologies
0040CC Silcom Manuf'g Technology
0040CD Tera Microsystems
0040CE Net-source
0040CF Strawberry TREE
0040D0 Mitac International
0040D1 Fukuda Denshi CO.
0040D2 Pagine
0040D3 Kimpsion International
0040D4 Gage Talker
0040D5 Sartorius AG
0040D6 Locamation B.V.
0040D7 Studio GEN
0040D8 Ocean Office Automation
0040D9 American Megatrends
0040DA Telspec
0040DB Advanced Technical Solutions
0040DC Tritec Electronic Gmbh
0040DD Hong Technologies
0040DE Elettronica SAN Giorgio
0040DF Digalog Systems
0040E0 Atomwide
0040E1 Marner International
0040E2 Mesa Ridge Technologies
0040E3 Quin Systems
0040E4 E-M Technology
0040E5 Sybus
0040E6 C.a.e.n.
0040E7 Arnos Instruments & Computer
0040E8 Charles River Data Systems
0040E9 Accord Systems
0040EA Plain Tree Systems
0040EB Martin Marietta
0040EC Mikasa System Engineering
0040ED Network Controls Int'natl
0040EE Optimem
0040EF Hypercom
0040F0 Micro Systems
0040F1 Chuo Electronics CO.
0040F2 Janich & Klass Computertechnik
0040F3 Netcor
0040F4 Cameo Communications
0040F5 OEM Engines
0040F6 Katron Computers
0040F7 Polaroid Medical Imaging SYS.
0040F8 Systemhaus Discom
0040F9 Combinet
0040FA Microboards
0040FB Cascade Communications
0040FC IBR Computer Technik Gmbh
0040FD LXE
0040FE Symplex Communications
0040FF Telebit
004252 RLX Technologies
004501 Versus Technology
005000 Nexo Communications
005001 Yamashita Systems
005002 Omnisec AG
005003 Gretag Macbeth AG
005004 3com
005006 TAC AB
005007 Siemens Telecommunication Systems Limited
005008 Tiva Microcomputer (tmc)
005009 Philips Broadband Networks
00500A Iris Technologies
00500B Cisco Systems
00500C e-Tek Labs
00500D Satori Electoric CO.
00500E Chromatis Networks
00500F Cisco Systems
005010 NovaNET Learning
005012 CBL - Gmbh
005013 Chaparral Network Storage
005014 Cisco Systems
005015 Bright Star Engineering
005016 Sst/woodhead Industries
005017 RSR S.r.l.
005018 AMIT
005019 Spring Tide Networks
00501A Uisiqn
00501B ABL Canada
00501C Jatom Systems
00501E Miranda Technologies
00501F MRG Systems
005020 Mediastar CO.
005021 EIS International
005022 Zonet Technology
005023 PG Design Electronics
005024 Navic Systems
005026 Cosystems
005027 Genicom
005028 Aval Communications
005029 1394 Printer Working Group
00502A Cisco Systems
00502B Genrad
00502C Soyo Computer
00502D Accel
00502E Cambex
00502F TollBridge Technologies
005030 Future Plus Systems
005031 Aeroflex Laboratories
005032 Picazo Communications
005033 Mayan Networks
005036 Netcam
005037 Koga Electronics CO.
005038 Dain Telecom CO.
005039 Mariner Networks
00503A Datong Electronics
00503B Mediafire
00503C Tsinghua Novel Electronics
00503E Cisco Systems
00503F Anchor Games
005040 Panasonic Electric Works Laboratory of America,/SLC Lab
005041 CTX Opto Electronic
005042 SCI Manufacturing Singapore PTE
005043 Marvell Semiconductor
005044 Asaca
005045 Rioworks Solutions
005046 Menicx International CO.
005047 Private
005048 Infolibria
005049 Ellacoya Networks
00504A Elteco A.S.
00504B Barconet N.V.
00504C Galil Motion Control
00504D Tokyo Electron Device
00504E Sierra Monitor
00504F Olencom Electronics
005050 Cisco Systems
005051 Iwatsu Electric CO.
005052 Tiara Networks
005053 Cisco Systems
005054 Cisco Systems
005055 Doms A/S
005056 VMWare
005057 Broadband Access Systems
005058 VegaStream Limted
005059 iBAHN
00505A Network Alchemy
00505B Kawasaki LSI U.s.a.
00505C Tundo
00505E Digitek Micrologic S.A.
00505F Brand Innovators
005060 Tandberg Telecom AS
005062 Kouwell Electronics  **
005063 OY Comsel System AB
005064 CAE Electronics
005065 Densei-lambad Co.
005066 AtecoM GmbH advanced telecomunication modules
005067 Aerocomm
005068 Electronic Industries Association
005069 PixStream Incorporated
00506A Edeva
00506B Spx-ateg
00506C G & L Beijer Electronics AB
00506D Videojet Systems
00506E Corder Engineering
00506F G-connect
005070 Chaintech Computer CO.
005071 Aiwa CO.
005072 Corvis
005073 Cisco Systems
005074 Advanced Hi-tech
005075 Kestrel Solutions
005076 IBM
005077 Prolific Technology
005078 Megaton House
005079 Private
00507A Xpeed
00507B Merlot Communications
00507C Videocon AG
00507D IFP
00507E Newer Technology
00507F DrayTek
005080 Cisco Systems
005081 Murata Machinery
005082 Foresson
005083 Gilbarco
005084 ATL Products
005086 Telkom SA
005087 Terasaki Electric CO.
005088 Amano
005089 Safety Management Systems
00508B Compaq Computer
00508C RSI Systems
00508D Abit Computer
00508E Optimation
00508F Asita Technologies Int'l
005090 Dctri
005091 Netaccess
005092 Rigaku Industrial
005093 Boeing
005094 Pace Micro Technology PLC
005095 Peracom Networks
005096 Salix Technologies
005097 Mmc-embedded Computertechnik Gmbh
005098 Globaloop
005099 3com Europe
00509A TAG Electronic Systems
00509B Switchcore AB
00509C Beta Research
00509D THE Industree B.V.
00509E Les Technologies SoftAcoustik
00509F Horizon Computer
0050A0 Delta Computer Systems
0050A1 Carlo Gavazzi
0050A2 Cisco Systems
0050A3 TransMedia Communications
0050A4 IO TECH
0050A5 Capitol Business Systems
0050A6 Optronics
0050A7 Cisco Systems
0050A8 OpenCon Systems
0050A9 Moldat Wireless Technolgies
0050AA Konica Minolta Holdings
0050AB Naltec
0050AC Maple Computer
0050AD CommUnique Wireless
0050AE Iwaki Electronics CO.
0050AF Intergon
0050B0 Technology Atlanta
0050B1 Giddings & Lewis
0050B2 Brodel Automation
0050B3 Voiceboard
0050B4 Satchwell Control Systems
0050B5 Fichet-bauche
0050B6 Good WAY IND. CO.
0050B7 Boser Technology CO.
0050B8 Inova Computers Gmbh & CO. KG
0050B9 Xitron Technologies
0050BA D-link
0050BB CMS Technologies
0050BC Hammer Storage Solutions
0050BD Cisco Systems
0050BE Fast Multimedia AG
0050BF Mototech
0050C0 Gatan
0050C1 Gemflex Networks
0050C2 Ieee Registration Authority
0050C4 IMD
0050C5 ADS Technologies
0050C6 Loop Telecommunication International
0050C8 Addonics Communications
0050C9 Maspro Denkoh
0050CA NET TO NET Technologies
0050CB Jetter
0050CC Xyratex
0050CD Digianswer A/S
0050CE LG International
0050CF Vanlink Communication Technology Research Institute
0050D0 Minerva Systems
0050D1 Cisco Systems
0050D2 CMC Electronics
0050D3 Digital Audio Processing
0050D4 Joohong Information
0050D5 AD Systems
0050D6 Atlas Copco Tools AB
0050D7 Telstrat
0050D8 Unicorn Computer
0050D9 Engetron-engenharia Eletronica IND. e COM. Ltda
0050DA 3com
0050DB Contemporary Control
0050DC TAS Telefonbau A. Schwabe Gmbh & CO. KG
0050DD Serra Soldadura
0050DE Signum Systems
0050DF AirFiber
0050E1 NS Tech Electronics SDN BHD
0050E2 Cisco Systems
0050E3 Terayon Communications Systems
0050E4 Apple Computer
0050E6 Hakusan
0050E7 Paradise Innovations (asia)
0050E8 Nomadix
0050EA XEL Communications
0050EB Alpha-top
0050EC Olicom A/S
0050ED Anda Networks
0050EE TEK Digitel
0050EF SPE Systemhaus GmbH
0050F0 Cisco Systems
0050F1 Libit Signal Processing
0050F2 Microsoft
0050F3 Global NET Information CO.
0050F4 Sigmatek Gmbh & CO. KG
0050F6 Pan-international Industrial
0050F7 Venture Manufacturing (singapore)
0050F8 Entrega Technologies
0050F9 Private
0050FA Oxtel
0050FB VSK Electronics
0050FC Edimax Technology CO.
0050FD Visioncomm CO.
0050FE Pctvnet ASA
0050FF Hakko Electronics CO.
006000 Xycom
006001 InnoSys
006002 Screen Subtitling Systems
006003 Teraoka Weigh System PTE
006004 Computadores Modulares SA
006005 Feedback Data
006006 Sotec CO.
006007 Acres Gaming
006008 3com
006009 Cisco Systems
00600A Sord Computer
00600B Logware Gmbh
00600C Applied Data Systems
00600D Digital Logic GmbH
00600E Wavenet International
00600F Westell
006010 Network Machines
006011 Crystal Semiconductor
006012 Power Computing
006013 Netstal Maschinen AG
006014 Edec CO.
006015 Net2net
006016 Clariion
006017 Tokimec
006018 Stellar ONE
006019 Roche Diagnostics
00601A Keithley Instruments
00601B Mesa Electronics
00601C Telxon
00601D Lucent Technologies
00601E Softlab
00601F Stallion Technologies
006020 Pivotal Networking
006021 DSC
006022 Vicom Systems
006023 Pericom Semiconductor
006024 Gradient Technologies
006025 Active Imaging PLC
006026 Viking Components
006027 Superior Modular Products
006028 Macrovision
006029 Cary Peripherals
00602A Symicron Computer Communications
00602B Peak Audio
00602C Linx Data Terminals
00602D Alerton Technologies
00602E Cyclades
00602F Cisco Systems
006030 Village Tronic Entwicklung
006031 HRK Systems
006032 I-cube
006033 Acuity Imaging
006034 Robert Bosch Gmbh
006035 Dallas Semiconductor
006036 Austrian Research Center Seibersdorf
006037 Philips Semiconductors
006038 Nortel Networks
006039 SanCom Technology
00603A Quick Controls
00603B Amtec spa
00603C Hagiwara Sys-com CO.
00603D 3CX
00603E Cisco Systems
00603F Patapsco Designs
006040 Netro
006041 Yokogawa Electric
006042 TKS (usa)
006043 ComSoft Systems
006044 Litton/poly-scientific
006045 Pathlight Technologies
006046 Vmetro
006047 Cisco Systems
006048 EMC
006049 Vina Technologies
00604A Saic Ideas Group
00604B Safe-com GmbH & Co. KG
00604C Sagem SA
00604D MMC Networks
00604E Cycle Computer
00604F Suzuki MFG. CO.
006050 Internix
006051 Quality Semiconductor
006052 Peripherals Enterprise CO.
006053 Toyoda Machine Works
006054 Controlware Gmbh
006055 Cornell University
006056 Network Tools
006057 Murata Manufacturing CO.
006058 Copper Mountain Communications
006059 Technical Communications
00605A Celcore
00605B IntraServer Technology
00605C Cisco Systems
00605D Scanivalve
00605E Liberty Technology Networking
00605F Nippon Unisoft
006060 Dawning Technologies
006061 Whistle Communications
006062 Telesync
006063 Psion Dacom PLC.
006064 Netcomm Limited
006065 Bernecker & Rainer Industrie-elektronic Gmbh
006066 Lacroix Technolgie
006067 Acer Netxus
006068 Eicon Technology
006069 Brocade Communications Systems
00606A Mitsubishi Wireless Communications.
00606B Synclayer
00606C Arescom
00606D Digital Equipment
00606E Davicom Semiconductor
00606F Clarion OF America
006070 Cisco Systems
006071 Midas LAB
006072 VXL Instruments, Limited
006073 Redcreek Communications
006074 QSC Audio Products
006075 Pentek
006076 Schlumberger Technologies Retail Petroleum Systems
006077 Prisa Networks
006078 Power Measurement
006079 Mainstream Data
00607A DVS GmbH
00607B Fore Systems
00607C WaveAccess
00607D Sentient Networks
00607E Gigalabs
00607F Aurora Technologies
006080 Microtronix Datacom
006081 Tv/com International
006082 Novalink Technologies
006083 Cisco Systems
006084 Digital Video
006085 Storage Concepts
006086 Logic Replacement TECH.
006087 Kansai Electric CO.
006088 White Mountain DSP
006089 Xata
00608A Citadel Computer
00608B ConferTech International
00608C 3com
00608D Unipulse
00608E HE Electronics, Technologie & Systemtechnik Gmbh
00608F Tekram Technology CO.
006090 Able Communications
006091 First Pacific Networks
006092 Micro/sys
006093 Varian
006094 IBM
006095 Accu-time Systems
006096 T.S. Microtech
006097 3com
006098 HT Communications
006099 SBE
00609A NJK Techno CO.
00609B Astro-med
00609C Perkin-Elmer Incorporated
00609D PMI Food Equipment Group
00609E ASC X3 - Information Technology Standards Secretariats
00609F Phast
0060A0 Switched Network Technologies
0060A1 VPNet
0060A2 Nihon Unisys Limited CO.
0060A3 Continuum Technology
0060A4 Grinaker System Technologies
0060A5 Performance Telecom
0060A6 Particle Measuring Systems
0060A7 Microsens Gmbh & CO. KG
0060A8 Tidomat AB
0060A9 Gesytec MbH
0060AA Intelligent Devices (idi)
0060AB Larscom Incorporated
0060AC Resilience
0060AD MegaChips
0060AE Trio Information Systems AB
0060AF Pacific Micro DATA
0060B0 Hewlett-packard CO.
0060B1 Input/output
0060B2 Process Control
0060B3 Z-com
0060B4 Glenayre R&D
0060B5 Keba Gmbh
0060B6 Land Computer CO.
0060B7 Channelmatic
0060B8 Corelis
0060B9 Nitsuko
0060BA Sahara Networks
0060BB Cabletron - Netlink
0060BC KeunYoung Electronics & Communication Co.
0060BD Hubbell-pulsecom
0060BE Webtronics
0060BF Macraigor Systems
0060C0 Nera AS
0060C1 WaveSpan
0060C2 MPL AG
0060C3 Netvision
0060C4 Soliton Systems K.K.
0060C5 Ancot
0060C6 DCS AG
0060C7 Amati Communications
0060C8 Kuka Welding Systems & Robots
0060C9 ControlNet
0060CA Harmonic Systems Incorporated
0060CB Hitachi Zosen
0060CC Emtrak, Incorporated
0060CD VideoServer
0060CE Acclaim Communications
0060CF Alteon Networks
0060D0 Snmp Research Incorporated
0060D1 Cascade Communications
0060D2 Lucent Technologies Taiwan Telecommunications CO.
0060D3 At&t
0060D4 Eldat Communication
0060D5 Miyachi Technos
0060D6 NovAtel Wireless Technologies
0060D7 Ecole Polytechnique Federale DE Lausanne (epfl)
0060D8 Elmic Systems
0060D9 Transys Networks
0060DA JBM Electronics CO.
0060DB NTP Elektronik A/S
0060DC Toyo Network Systems Co
0060DD Myricom
0060DE Kayser-threde Gmbh
0060DF CNT
0060E0 Axiom Technology CO.
0060E1 Orckit Communications
0060E2 Quest Engineering & Development
0060E3 Arbin Instruments
0060E4 Compuserve
0060E5 Fuji Automation CO.
0060E6 Shomiti Systems Incorporated
0060E7 Randata
0060E8 Hitachi Computer Products (america)
0060E9 Atop Technologies
0060EA StreamLogic
0060EB Fourthtrack Systems
0060EC Hermary Opto Electronics
0060ED Ricardo Test Automation
0060EE Apollo
0060EF Flytech Technology CO.
0060F0 Johnson & Johnson Medical
0060F1 EXP Computer
0060F2 Lasergraphics
0060F3 Performance Analysis Broadband, Spirent plc
0060F4 Advanced Computer Solutions
0060F5 Icon WEST
0060F6 Nextest Communications Products
0060F7 Datafusion Systems
0060F8 Loran International Technologies
0060F9 Diamond Lane Communications
0060FA Educational Technology Resources
0060FB Packeteer
0060FC Conservation Through Innovation
0060FD NetICs
0060FE Lynx System Developers
0060FF QuVis
0070B0 M/a-com Companies
0070B3 Data Recall
008000 Multitech Systems
008001 Periphonics
008002 Satelcom (uk)
008003 Hytec Electronics
008004 Antlow Communications
008005 Cactus Computer
008006 Compuadd
008007 Dlog Nc-systeme
008008 Dynatech Computer Systems
008009 Jupiter Systems
00800A Japan Computer
00800B CSK
00800C Videcom Limited
00800D Vosswinkel F.U.
00800E Atlantix
00800F Standard Microsystems
008010 Commodore International
008011 Digital Systems Int'l.
008012 Integrated Measurement Systems
008013 Thomas-conrad
008014 Esprit Systems
008015 Seiko Systems
008016 Wandel AND Goltermann
008017 PFU Limited
008018 Kobe Steel
008019 Dayna Communications
00801A Bell Atlantic
00801B Kodiak Technology
00801C Newport Systems Solutions
00801D Integrated Inference Machines
00801E Xinetron
00801F Krupp Atlas Electronik Gmbh
008020 Network Products
008021 Alcatel Canada
008022 Scan-optics
008023 Integrated Business Networks
008024 Kalpana
008025 Stollmann Gmbh
008026 Network Products
008027 Adaptive Systems
008028 Tradpost (hk)
008029 Eagle Technology
00802A Test Systems & Simulations
00802B Integrated Marketing CO
00802C THE Sage Group PLC
00802D Xylogics
00802E Castle Rock Computing
00802F National Instruments
008030 Nexus Electronics
008031 Basys
008032 Access CO.
008033 Formation
008034 SMT Goupil
008035 Technology Works
008036 Reflex Manufacturing Systems
008037 Ericsson Group
008038 Data Research & Applications
008039 Alcatel STC Australia
00803A Varityper
00803B APT Communications
00803C TVS Electronics
00803D Surigiken CO.
00803E Synernetics
00803F Tatung Company
008040 John Fluke Manufacturing CO.
008041 VEB Kombinat Robotron
008042 Force Computers
008043 Networld
008044 Systech Computer
008045 Matsushita Electric IND. CO
008046 University OF Toronto
008047 In-net
008048 Compex Incorporated
008049 Nissin Electric CO.
00804A Pro-log
00804B Eagle Technologiesltd.
00804C Contec CO.
00804D Cyclone Microsystems
00804E Apex Computer Company
00804F Daikin Industries
008050 Ziatech
008051 Fibermux
008052 Technically Elite Concepts
008053 Intellicom
008054 Frontier Technologies
008055 Fermilab
008056 Sphinx Elektronik Gmbh
008057 Adsoft
008058 Printer Systems
008059 Stanley Electric CO.
00805A Tulip Computers Internat'l B.V
00805B Condor Systems
00805C Agilis
00805D Canstar
00805E LSI Logic
00805F Compaq Computer
008060 Network Interface
008061 Litton Systems
008062 Interface  CO.
008063 Richard Hirschmann Gmbh & CO.
008064 Wyse Technology
008065 Cybergraphic Systems
008066 Arcom Control Systems
008067 Square D Company
008068 Yamatech Scientific
008069 Computone Systems
00806A ERI (empac Research)
00806B Schmid Telecommunication
00806C Cegelec Projects
00806D Century Systems
00806E Nippon Steel
00806F Onelan
008070 Computadoras Micron
008071 SAI Technology
008072 Microplex Systems
008073 DWB Associates
008074 Fisher Controls
008075 Parsytec Gmbh
008076 Mcnc
008077 Brother Industries
008078 Practical Peripherals
008079 Microbus Designs
00807A Aitech Systems
00807B Artel Communications
00807C Fibercom
00807D Equinox Systems
00807E Southern Pacific
00807F Dy-4 Incorporated
008080 Datamedia
008081 Kendall Square Research
008082 PEP Modular Computers Gmbh
008083 Amdahl
008084 THE Cloud
008085 H-three Systems
008086 Computer Generation
008087 OKI Electric Industry CO.
008088 Victor Company OF Japan
008089 Tecnetics (pty)
00808A Summit Microsystems
00808B Dacoll Limited
00808C NetScout Systems
00808D Westcoast Technology B.V.
00808E Radstone Technology
00808F C. Itoh Electronics
008090 Microtek International
008091 Tokyo Electric Co.
008092 Japan Computer Industry
008093 Xyron
008094 Alfa Laval Automation AB
008095 Basic Merton Handelsges.m.b.h.
008096 Human Designed Systems
008097 Centralp Automatismes
008098 TDK
008099 Klockner Moeller IPC
00809A Novus Networks
00809B Justsystem
00809C Luxcom
00809D Commscraft
00809E Datus Gmbh
00809F Alcatel Business Systems
0080A0 Edisa Hewlett Packard S/A
0080A1 Microtest
0080A2 Creative Electronic Systems
0080A3 Lantronix
0080A4 Liberty Electronics
0080A5 Speed International
0080A6 Republic Technology
0080A7 Measurex
0080A8 Vitacom
0080A9 Clearpoint Research
0080AA Maxpeed
0080AB Dukane Network Integration
0080AC Imlogix, Division OF Genesys
0080AD Cnet Technology
0080AE Hughes Network Systems
0080AF Allumer CO.
0080B0 Advanced Information
0080B1 Softcom A/S
0080B2 Network Equipment Technologies
0080B3 Aval Data
0080B4 Sophia Systems
0080B5 United Networks
0080B6 Themis Computer
0080B7 Stellar Computer
0080B8 BUG, Incorporated
0080B9 Arche Technoligies
0080BA Specialix (asia) PTE
0080BB Hughes LAN Systems
0080BC Hitachi Engineering CO.
0080BD THE Furukawa Electric CO.
0080BE Aries Research
0080BF Takaoka Electric MFG. CO.
0080C0 Penril Datacomm
0080C1 Lanex
0080C2 Ieee 802.1 Committee
0080C3 Bicc Information Systems & SVC
0080C4 Document Technologies
0080C5 Novellco DE Mexico
0080C6 National Datacomm
0080C7 Xircom
0080C8 D-link Systems
0080C9 Alberta Microelectronic Centre
0080CA Netcom Research Incorporated
0080CB Falco Data Products
0080CC Microwave Bypass Systems
0080CD Micronics Computer
0080CE Broadcast Television Systems
0080CF Embedded Performance
0080D0 Computer Peripherals
0080D1 Kimtron
0080D2 Shinnihondenko CO.
0080D3 Shiva
0080D4 Chase Research
0080D5 Cadre Technologies
0080D6 Nuvotech
0080D7 Fantum Engineering
0080D8 Network Peripherals
0080D9 EMK Elektronik
0080DA Bruel & Kjaer
0080DB Graphon
0080DC Picker International
0080DD GMX/gimix
0080DE Gipsi S.A.
0080DF ADC Codenoll Technology
0080E0 XTP Systems
0080E1 Stmicroelectronics
0080E2 T.d.i. CO.
0080E3 Coral Network
0080E4 Northwest Digital Systems
0080E5 Mylex
0080E6 Peer Networks
0080E7 Lynwood Scientific DEV.
0080E8 Cumulus Corporatiion
0080E9 Madge
0080EA Adva Optical Networking
0080EB Compcontrol B.V.
0080EC Supercomputing Solutions
0080ED IQ Technologies
0080EE Thomson CSF
0080EF Rational
0080F0 Panasonic Communications Co.
0080F1 Opus Systems
0080F2 Raycom Systems
0080F3 SUN Electronics
0080F4 Telemecanique Electrique
0080F5 Quantel
0080F6 Synergy Microsystems
0080F7 Zenith Electronics
0080F8 Mizar
0080F9 Heurikon
0080FA RWT Gmbh
0080FB BVM Limited
0080FC Avatar
0080FD Exsceed Corpration
0080FE Azure Technologies
0080FF SOC. DE Teleinformatique RTC
009000 Diamond Multimedia
009001 Nishimu Electronics Industries CO.
009002 Allgon AB
009003 Aplio
009004 3com Europe
009005 Protech Systems CO.
009006 Hamamatsu Photonics K.K.
009007 Domex Technology
009008 HanA Systems
009009 i Controls
00900A Proton Electronic Industrial CO.
00900B Lanner Electronics
00900C Cisco Systems
00900D Overland Data
00900E Handlink Technologies
00900F Kawasaki Heavy Industries
009010 Simulation Laboratories
009011 Wavtrace
009012 Globespan Semiconductor
009013 Samsan
009014 Rotork Instruments
009015 Centigram Communications
009016 ZAC
009017 Zypcom
009018 ITO Electric Industry CO
009019 Hermes Electronics CO.
00901A Unisphere Solutions
00901B Digital Controls
00901C mps Software Gmbh
00901D PEC (nz)
00901E Selesta Ingegne RIA S.p.a.
00901F Adtec Productions
009020 Philips Analytical X-ray B.V.
009021 Cisco Systems
009022 Ivex
009023 Zilog
009024 Pipelinks
009025 Vision Systems
009026 Advanced Switching Communications
009027 Intel
009028 Nippon Signal CO.
009029 Crypto AG
00902A Communication Devices
00902B Cisco Systems
00902C Data & Control Equipment
00902D Data Electronics (aust.)
00902E Namco Limited
00902F Netcore Systems
009030 Honeywell-dating
009031 Mysticom
009032 Pelcombe Group
009033 Innovaphone AG
009034 Imagic
009035 Alpha Telecom
009036 ens
009037 Acucomm
009038 Fountain Technologies
009039 Shasta Networks
00903A Nihon Media Tool
00903B TriEMS Research Lab
00903C Atlantic Network Systems
00903D Biopac Systems
00903E N.V. Philips Industrial Activities
00903F Aztec Radiomedia
009040 Siemens Network Convergence
009041 Applied Digital Access
009042 ECCS
009043 Nichibei Denshi CO.
009044 Assured Digital
009045 Marconi Communications
009046 Dexdyne
009047 Giga Fast E.
009048 Zeal
009049 Entridia
00904A Concur System Technologies
00904B GemTek Technology Co.
00904C Epigram
00904D Spec S.A.
00904E Delem BV
00904F ABB Power T&D Company
009050 Teleste OY
009051 Ultimate Technology
009052 Selcom Elettronica S.r.l.
009053 Daewoo Electronics CO.
009054 Innovative Semiconductors
009055 Parker Hannifin Compumotor Division
009056 Telestream
009057 AANetcom
009058 Ultra Electronics, Command and Control Systems
009059 Telecom Device K.K.
00905A Dearborn Group
00905B Raymond AND LAE Engineering
00905C Edmi
00905D Netcom Sicherheitstechnik Gmbh
00905E Rauland-borg
00905F Cisco Systems
009060 System Create
009061 Pacific Research & Engineering
009062 ICP Vortex Computersysteme Gmbh
009063 Coherent Communications Systems
009064 Thomson Broadcast Systems
009065 Finisar
009066 Troika Networks
009067 WalkAbout Computers
009068 DVT
009069 Juniper Networks
00906A Turnstone Systems
00906B Applied Resources
00906C Sartorius Hamburg GmbH
00906D Cisco Systems
00906E Praxon
00906F Cisco Systems
009070 NEO Networks
009071 Applied Innovation
009072 Simrad AS
009073 Gaio Technology
009074 Argon Networks
009075 NEC DO Brasil S.A.
009076 FMT Aircraft Gate Support Systems AB
009077 Advanced Fibre Communications
009078 MER Telemanagement Solutions
009079 ClearOne
00907A Spectralink
00907B E-tech
00907C Digitalcast
00907D Lake Communications
00907E Vetronix
00907F WatchGuard Technologies
009080 NOT Limited
009081 Aloha Networks
009082 Force Institute
009083 Turbo Communication
009084 Atech System
009085 Golden Enterprises
009086 Cisco Systems
009087 Itis
009088 Baxall Security
009089 Softcom Microsystems
00908A Bayly Communications
00908B PFU Systems
00908C Etrend Electronics
00908D Vickers Electronics Systems
00908E Nortel Networks Broadband Access
00908F Audio Codes
009090 I-bus
009091 DigitalScape
009092 Cisco Systems
009093 Nanao
009094 Osprey Technologies
009095 Universal Avionics
009096 Askey Computer
009097 Sycamore Networks
009098 SBC Designs
009099 Allied Telesis
00909A ONE World Systems
00909B Markpoint AB
00909C Terayon Communications Systems
00909D NovaTech Process Solutions
00909E Critical IO
00909F Digi-data
0090A0 8X8
0090A1 Flying PIG Systems
0090A2 Cybertan Technology
0090A3 Corecess
0090A4 Altiga Networks
0090A5 Spectra Logic
0090A6 Cisco Systems
0090A7 Clientec
0090A8 NineTiles Networks
0090A9 Western Digital
0090AA Indigo Active Vision Systems Limited
0090AB Cisco Systems
0090AC Optivision
0090AD Aspect Electronics
0090AE Italtel S.p.a.
0090AF J. Morita MFG.
0090B0 Vadem
0090B1 Cisco Systems
0090B2 Avici Systems
0090B3 Agranat Systems
0090B4 Willowbrook Technologies
0090B5 Nikon
0090B6 Fibex Systems
0090B7 Digital Lightwave
0090B8 Rohde & Schwarz Gmbh & CO. KG
0090B9 Beran Instruments
0090BA Valid Networks
0090BB Tainet Communication System
0090BC Telemann CO.
0090BD Omnia Communications
0090BE Ibc/integrated Business Computers
0090BF Cisco Systems
0090C0 K.J. LAW Engineers
0090C1 Peco II
0090C2 JK microsystems
0090C3 Topic Semiconductor
0090C4 Javelin Systems
0090C5 Internet Magic
0090C6 Optim Systems
0090C7 Icom
0090C8 Waverider Communications (canada)
0090C9 Dpac Technologies
0090CA Accord Video Telecommunications
0090CB Wireless OnLine
0090CC Planet Communications
0090CD Ent-empresa Nacional DE Telecommunicacoes
0090CE Tetra Gmbh
0090CF Nortel
0090D0 Thomson Telecom Belgium
0090D1 Leichu Enterprise CO.
0090D2 Artel Video Systems
0090D3 Giesecke & Devrient Gmbh
0090D4 BindView Development
0090D5 Euphonix
0090D6 Crystal Group
0090D7 NetBoost
0090D8 Whitecross Systems
0090D9 Cisco Systems
0090DA Dynarc
0090DB Next Level Communications
0090DC Teco Information Systems
0090DD THE Miharu Communications CO.
0090DE Cardkey Systems
0090DF Mitsubishi Chemical America
0090E0 Systran
0090E1 Telena S.p.a.
0090E2 Distributed Processing Technology
0090E3 Avex Electronics
0090E4 NEC America
0090E5 Teknema
0090E6 Acer Laboratories
0090E7 Horsch Elektronik AG
0090E8 Moxa Technologies
0090E9 Janz Computer AG
0090EA Alpha Technologies
0090EB Sentry Telecom Systems
0090EC Pyrescom
0090ED Central System Research CO.
0090EE Personal Communications Technologies
0090EF Integrix
0090F0 Harmonic Video Systems
0090F1 DOT Hill Systems
0090F2 Cisco Systems
0090F3 Aspect Communications
0090F4 Lightning Instrumentation
0090F5 Clevo CO.
0090F6 Escalate Networks
0090F7 Nbase Communications
0090F8 Mediatrix Telecom
0090F9 Leitch
0090FA Emulex
0090FB Portwell
0090FC Network Computing Devices
0090FD CopperCom
0090FE Elecom CO.,  (laneed DIV.)
0090FF Tellus Technology
0091D6 Crystal Group
009D8E Cardiac Recorders
00A000 Centillion Networks
00A001 DRS Signal Solutions
00A002 Leeds & Northrup Australia
00A003 Staefa Control System
00A004 Netpower
00A005 Daniel Instruments
00A006 Image Data Processing System Group
00A007 Apexx Technology
00A008 Netcorp
00A009 Whitetree Network
00A00A R.d.c. Communication
00A00B Computex CO.
00A00C Kingmax Technology
00A00D THE Panda Project
00A00E Visual Networks
00A00F Broadband Technologies
00A010 Syslogic Datentechnik AG
00A011 Mutoh Industries
00A012 B.a.t.m. Advanced Technologies
00A013 Teltrend
00A014 Csir
00A015 Wyle
00A016 Micropolis
00A017 J B
00A018 Creative Controllers
00A019 Nebula Consultants
00A01A Binar Elektronik AB
00A01B Premisys Communications
00A01C Nascent Networks
00A01D Sixnet
00A01E EST
00A01F Tricord Systems
00A020 Citicorp/tti
00A021 General Dynamics
00A022 Centre FOR Development OF Advanced Computing
00A023 Applied Creative Technology
00A024 3com
00A025 Redcom Labs
00A026 Teldat
00A027 Firepower Systems
00A028 Conner Peripherals
00A029 Coulter
00A02A Trancell Systems
00A02B Transitions Research
00A02C interWAVE Communications
00A02D 1394 Trade Association
00A02E Brand Communications
00A02F Pirelli Cavi
00A030 Captor Nv/sa
00A031 Hazeltine, MS 1-17
00A032 GES Singapore PTE.
00A033 imc MeBsysteme GmbH
00A034 Axel
00A035 Cylink
00A036 Applied Network Technology
00A037 Datascope
00A038 Email Electronics
00A039 Ross Technology
00A03A Kubotek
00A03B Toshin Electric CO.
00A03C Eg&g Nuclear Instruments
00A03D Opto-22
00A03E ATM Forum
00A03F Computer Society Microprocessor & Microprocessor Standards
00A040 Apple Computer
00A041 Inficon
00A042 Spur Products
00A043 American Technology LABS
00A044 NTT IT CO.
00A045 Phoenix Contact Gmbh & CO.
00A046 Scitex
00A047 Integrated Fitness
00A048 Questech
00A049 Digitech Industries
00A04A Nisshin Electric CO.
00A04B TFL LAN
00A04C Innovative Systems & Technologies
00A04D EDA Instruments
00A04E Voelker Technologies
00A04F Ameritec
00A050 Cypress Semiconductor
00A051 Angia Communications.
00A052 Stanilite Electronics
00A053 Compact Devices
00A054 Private
00A055 Data Device
00A056 Micropross
00A057 Lancom Systems Gmbh
00A058 Glory
00A059 Hamilton Hallmark
00A05A Kofax Image Products
00A05B Marquip
00A05C Inventory Conversion
00A05D CS Computer Systeme Gmbh
00A05E Myriad Logic
00A05F BTG Engineering BV
00A060 Acer Peripherals
00A061 Puritan Bennett
00A062 AES Prodata
00A063 JRL Systems
00A064 Kvb/analect
00A065 Symantec
00A066 ISA CO.
00A067 Network Services Group
00A068 BHP Limited
00A069 Symmetricom
00A06A Verilink
00A06B DMS Dorsch Mikrosystem Gmbh
00A06C Shindengen Electric MFG. CO.
00A06D Mannesmann Tally
00A06E Austron
00A06F THE Appcon Group
00A070 Coastcom
00A071 Video Lottery Technologies
00A072 Ovation Systems
00A073 Com21
00A074 Perception Technology
00A075 Micron Technology
00A076 Cardware LAB
00A077 Fujitsu Nexion
00A078 Marconi Communications
00A079 Alps Electric (usa)
00A07A Advanced Peripherals Technologies
00A07B Dawn Computer Incorporation
00A07C Tonyang Nylon CO.
00A07D Seeq Technology
00A07E Avid Technology
00A07F Gsm-syntel
00A080 SBE
00A081 Alcatel Data Networks
00A082 NKT Elektronik A/S
00A083 Asimmphony Turkey
00A084 Dataplex
00A085 Private
00A086 Amber Wave Systems
00A087 Zarlink Semiconductor
00A088 Essential Communications
00A089 Xpoint Technologies
00A08A Brooktrout Technology
00A08B Aston Electronic Designs
00A08C MultiMedia LANs
00A08D Jacomo
00A08E Nokia Internet Communications
00A08F Desknet Systems
00A090 TimeStep
00A091 Applicom International
00A092 H. Bollmann Manufacturers
00A093 B/E Aerospace
00A094 Comsat
00A095 Acacia Networks
00A096 Mitumi Electric CO.
00A097 JC Information Systems
00A098 Network Appliance
00A099 K-net
00A09A Nihon Kohden America
00A09B Qpsx Communications
00A09C Xyplex
00A09D Johnathon Freeman Technologies
00A09E Ictv
00A09F Commvision
00A0A0 Compact DATA
00A0A1 Epic Data
00A0A2 Digicom S.p.a.
00A0A3 Reliable Power Meters
00A0A4 Micros Systems
00A0A5 Teknor Microsysteme
00A0A6 M.I. Systems
00A0A7 Vorax
00A0A8 Renex
00A0A9 Navtel Communications
00A0AA Spacelabs Medical
00A0AB Netcs Informationstechnik Gmbh
00A0AC Gilat Satellite Networks
00A0AD Marconi SPA
00A0AE Nucom Systems
00A0AF WMS Industries
00A0B0 I-O Data Device
00A0B1 First Virtual
00A0B2 Shima Seiki
00A0B3 Zykronix
00A0B4 Texas Microsystems
00A0B5 3H Technology
00A0B6 Sanritz Automation CO.
00A0B7 Cordant
00A0B8 Symbios Logic
00A0B9 Eagle Technology
00A0BA Patton Electronics CO.
00A0BB Hilan Gmbh
00A0BC Viasat, Incorporated
00A0BD I-tech
00A0BE Integrated Circuit Systems, Communications Group
00A0BF Wireless Data Group Motorola
00A0C0 Digital Link
00A0C1 Ortivus Medical AB
00A0C2 R.A. Systems CO.
00A0C3 Unicomputer Gmbh
00A0C4 Cristie Electronics
00A0C5 Zyxel Communication
00A0C6 Qualcomm Incorporated
00A0C7 Tadiran Telecommunications
00A0C8 Adtran
00A0C9 Intel - Hf1-06
00A0CA Fujitsu Denso
00A0CB ARK Telecommunications
00A0CC Lite-on Communications
00A0CD DR. Johannes Heidenhain Gmbh
00A0CE Astrocom
00A0CF Sotas
00A0D0 TEN X Technology
00A0D1 Inventec
00A0D2 Allied Telesis International
00A0D3 Instem Computer Systems
00A0D4 Radiolan
00A0D5 Sierra Wireless
00A0D6 SBE
00A0D7 Kasten Chase Applied Research
00A0D8 Spectra - TEK
00A0D9 Convex Computer
00A0DA Integrated Systems Technology
00A0DB Fisher & Paykel Production
00A0DC O.N. Electronic CO.
00A0DD Azonix
00A0DE Yamaha
00A0DF STS Technologies
00A0E0 Tennyson Technologies
00A0E1 Westport Research Associates
00A0E2 Keisoku Giken
00A0E3 XKL Systems
00A0E4 Optiquest
00A0E5 NHC Communications
00A0E6 Dialogic
00A0E7 Central Data
00A0E8 Reuters Holdings PLC
00A0E9 Electronic Retailing Systems International
00A0EA Ethercom
00A0EB Encore Networks
00A0EC Transmitton
00A0ED Brooks Automation
00A0EE Nashoba Networks
00A0EF Lucidata
00A0F0 Toronto Microelectronics
00A0F1 MTI
00A0F2 Infotek Communications
00A0F3 Staubli
00A0F4 GE
00A0F5 Radguard
00A0F6 AutoGas Systems
00A0F7 V.I Computer
00A0F8 Symbol Technologies
00A0F9 Bintec Communications Gmbh
00A0FA Marconi Communication GmbH
00A0FB Toray Engineering CO.
00A0FC Image Sciences
00A0FD Scitex Digital Printing
00A0FE Boston Technology
00A0FF Tellabs Operations
00AA00 Intel
00AA01 Intel
00AA02 Intel
00AA3C Olivetti Telecom SPA (olteco)
00B009 Grass Valley Group
00B017 InfoGear Technology
00B019 Casi-Rusco
00B01C Westport Technologies
00B01E Rantic Labs
00B02A Orsys Gmbh
00B02D ViaGate Technologies
00B03B HiQ Networks
00B048 Marconi Communications
00B04A Cisco Systems
00B052 Intellon
00B064 Cisco Systems
00B069 Honewell Oy
00B06D Jones Futurex
00B080 Mannesmann Ipulsys B.V.
00B086 LocSoft Limited
00B08E Cisco Systems
00B091 Transmeta
00B094 Alaris
00B09A Morrow Technologies
00B09D Point Grey Research
00B0AC Siae-microelettronica S.p.a.
00B0AE Symmetricom
00B0B3 Xstreamis PLC
00B0C2 Cisco Systems
00B0C7 Tellabs Operations
00B0CE Technology Rescue
00B0D0 Dell Computer
00B0DB Nextcell
00B0DF Reliable Data Technology
00B0E7 British Federal
00B0EC Eacem
00B0EE Ajile Systems
00B0F0 Caly Networks
00B0F5 NetWorth Technologies
00BAC0 Biometric Access Company
00BB01 Octothorpe
00BBF0 Ungermann-bass
00C000 Lanoptics
00C001 Diatek Patient Managment
00C002 Sercomm
00C003 Globalnet Communications
00C004 Japan Business Computerltd
00C005 Livingston Enterprises
00C006 Nippon Avionics CO.
00C007 Pinnacle Data Systems
00C008 Seco SRL
00C009 KT Technology (S) PTE
00C00A Micro Craft
00C00B Norcontrol A.S.
00C00C Relia Technolgies
00C00D Advanced Logic Research
00C00E Psitech
00C00F Quantum Software Systems
00C010 Hirakawa Hewtech
00C011 Interactive Computing Devices
00C012 Netspan
00C013 Netrix
00C014 Telematics Calabasas Int'l
00C015 NEW Media
00C016 Electronic Theatre Controls
00C017 Forte Networks
00C018 Lanart
00C019 Leap Technology
00C01A Corometrics Medical Systems
00C01B Socket Communications
00C01C Interlink Communications
00C01D Grand Junction Networks
00C01E LA Francaise DES Jeux
00C01F S.e.r.c.e.l.
00C020 Arco Electronic, Control
00C021 Netexpress
00C022 Lasermaster Technologies
00C023 Tutankhamon Electronics
00C024 Eden Sistemas DE Computacao SA
00C025 Dataproducts
00C026 Lans Technology CO.
00C027 Cipher Systems
00C028 Jasco
00C029 Nexans Deutschland AG - ANS
00C02A Ohkura Electric CO.
00C02B Gerloff Gesellschaft FUR
00C02C Centrum Communications
00C02D Fuji Photo Film CO.
00C02E Netwiz
00C02F Okuma
00C030 Integrated Engineering B. V.
00C031 Design Research Systems
00C032 I-cubed Limited
00C033 Telebit Communications APS
00C034 Transaction Network
00C035 Quintar Company
00C036 Raytech Electronic
00C037 Dynatem
00C038 Raster Image Processing System
00C039 Teridian Semiconductor
00C03A Men-mikro Elektronik Gmbh
00C03B Multiaccess Computing
00C03C Tower Tech S.r.l.
00C03D Wiesemann & Theis Gmbh
00C03E FA. GEBR. Heller Gmbh
00C03F Stores Automated Systems
00C040 Ecci
00C041 Digital Transmission Systems
00C042 Datalux
00C043 Stratacom
00C044 Emcom
00C045 Isolation Systems
00C046 Kemitron
00C047 Unimicro Systems
00C048 BAY Technical Associates
00C049 U.S. Robotics
00C04A Group 2000 AG
00C04B Creative Microsystems
00C04C Department OF Foreign Affairs
00C04D Mitec
00C04E Comtrol
00C04F Dell Computer
00C050 Toyo Denki Seizo K.K.
00C051 Advanced Integration Research
00C052 Burr-brown
00C053 Concerto Software
00C054 Network Peripherals
00C055 Modular Computing Technologies
00C056 Somelec
00C057 Myco Electronics
00C058 Dataexpert
00C059 Nippon Denso CO.
00C05A Semaphore Communications
00C05B Networks Northwest
00C05C Elonex PLC
00C05D L&N Technologies
00C05E Vari-lite
00C05F Fine-pal Company Limited
00C060 ID Scandinavia AS
00C061 Solectek
00C062 Impulse Technology
00C063 Morning Star Technologies
00C064 General Datacomm IND.
00C065 Scope Communications
00C066 Docupoint
00C067 United Barcode Industries
00C068 Philip Drake Electronics
00C069 Axxcelera Broadband Wireless
00C06A Zahner-elektrik Gmbh & CO. KG
00C06B OSI Plus
00C06C Svec Computer
00C06D Boca Research
00C06E Haft Technology
00C06F Komatsu
00C070 Sectra Secure-transmission AB
00C071 Areanex Communications
00C072 KNX
00C073 Xedia
00C074 Toyoda Automatic Loom
00C075 Xante
00C076 I-data International A-S
00C077 Daewoo Telecom
00C078 Computer Systems Engineering
00C079 Fonsys Co.
00C07A Priva B.V.
00C07B Ascend Communications
00C07C Hightech Information
00C07D Risc Developments
00C07E Kubota Electronic
00C07F Nupon Computing
00C080 Netstar
00C081 Metrodata
00C082 Moore Products CO.
00C083 Trace Mountain Products
00C084 Data Link
00C085 Electronics FOR Imaging
00C086 THE Lynk
00C087 Uunet Technologies
00C088 EKF Elektronik Gmbh
00C089 Telindus Distribution
00C08A Lauterbach Datentechnik Gmbh
00C08B Risq Modular Systems
00C08C Performance Technologies
00C08D Tronix Product Development
00C08E Network Information Technology
00C08F Matsushita Electric Works
00C090 Praim S.r.l.
00C091 Jabil Circuit
00C092 Mennen Medical
00C093 Alta Research
00C094 VMX
00C095 Znyx
00C096 Tamura
00C097 Archipel SA
00C098 Chuntex Electronic CO.
00C099 Yoshiki Industrial Co.
00C09A Photonics
00C09B Reliance Comm/tec
00C09C TOA Electronic
00C09D Distributed Systems Int'l
00C09E Cache Computers
00C09F Quanta Computer
00C0A0 Advance Micro Research
00C0A1 Tokyo Denshi Sekei CO.
00C0A2 Intermedium A/S
00C0A3 Dual Enterprises
00C0A4 Unigraf OY
00C0A5 Dickens Data Systems
00C0A6 Exicom Australia
00C0A7 Seel
00C0A8 GVC
00C0A9 Barron Mccann
00C0AA Silicon Valley Computer
00C0AB Telco Systems
00C0AC Gambit Computer Communications
00C0AD Marben Communication Systems
00C0AE Towercom CO. DBA PC House
00C0AF Teklogix
00C0B0 GCC Technologies
00C0B1 Genius NET CO.
00C0B2 Norand
00C0B3 Comstat Datacomm
00C0B4 Myson Technology
00C0B5 Corporate Network Systems
00C0B6 Snap Appliance
00C0B7 American Power Conversion
00C0B8 Fraser's Hill
00C0B9 Funk Software
00C0BA Netvantage
00C0BB Forval Creative
00C0BC Telecom Australia/cssc
00C0BD Inex Technologies
00C0BE Alcatel - SEL
00C0BF Technology Concepts
00C0C0 Shore Microsystems
00C0C1 Quad/graphics
00C0C2 Infinite Networks
00C0C3 Acuson Computed Sonography
00C0C4 Computer Operational
00C0C5 SID Informatica
00C0C6 Personal Media
00C0C7 Sparktrum Microsystems
00C0C8 Micro Byte
00C0C9 Elsag Bailey Process
00C0CA ALFA
00C0CB Control Technology
00C0CC Telesciences CO Systems
00C0CD Comelta
00C0CE CEI Systems & Engineering PTE
00C0CF Imatran Voima OY
00C0D0 Ratoc System
00C0D1 Comtree Technology
00C0D2 Syntellect
00C0D3 Olympus Image Systems
00C0D4 Axon Networks
00C0D5 Quancom Electronic Gmbh
00C0D6 J1 Systems
00C0D7 Taiwan Trading Center DBA
00C0D8 Universal Data Systems
00C0D9 Quinte Network Confidentiality
00C0DA Nice Systems
00C0DB IPC (pte)
00C0DC EOS Technologies
00C0DD QLogic
00C0DE Zcomm
00C0DF KYE Systems
00C0E0 DSC Communication
00C0E1 Sonic Solutions
00C0E2 Calcomp
00C0E3 Ositech Communications
00C0E4 Siemens Building
00C0E5 Gespac
00C0E6 Verilink
00C0E7 Fiberdata AB
00C0E8 Plexcom
00C0E9 OAK Solutions
00C0EA Array Technology
00C0EB SEH Computertechnik Gmbh
00C0EC Dauphin Technology
00C0ED US Army Electronic
00C0EE Kyocera
00C0EF Abit
00C0F0 Kingston Technology
00C0F1 Shinko Electric CO.
00C0F2 Transition Networks
00C0F3 Network Communications
00C0F4 Interlink System CO.
00C0F5 Metacomp
00C0F6 Celan Technology
00C0F7 Engage Communication
00C0F8 About Computing
00C0F9 Motorola Embedded Computing Group
00C0FA Canary Communications
00C0FB Advanced Technology Labs
00C0FC Elastic Reality
00C0FD Prosum
00C0FE Aptec Computer Systems
00C0FF DOT Hill Systems
00CBBD Cambridge Broadband
00CF1C Communication Machinery
00D000 Ferran Scientific
00D001 VST Technologies
00D002 Ditech
00D003 Comda Enterprises
00D004 Pentacom
00D005 ZHS Zeitmanagementsysteme
00D006 Cisco Systems
00D007 MIC Associates
00D008 Mactell
00D009 Hsing TECH. Enterprise CO.
00D00A Lanaccess Telecom S.A.
00D00B RHK Technology
00D00C Snijder Micro Systems
00D00D Micromeritics Instrument
00D00E Pluris
00D00F Speech Design Gmbh
00D010 Convergent Networks
00D011 Prism Video
00D012 Gateworks
00D013 Primex Aerospace Company
00D014 ROOT
00D015 Univex Microtechnology
00D016 SCM Microsystems
00D017 Syntech Information CO.
00D018 QWES. COM
00D019 Dainippon Screen Corporate
00D01A Urmet  TLC S.p.a.
00D01B Mimaki Engineering CO.
00D01C SBS Technologies,
00D01D Furuno Electric CO.
00D01E Pingtel
00D01F Ctam
00D020 AIM System
00D021 Regent Electronics
00D022 Incredible Technologies
00D023 Infortrend Technology
00D024 Cognex
00D025 Xrosstech
00D026 Hirschmann Austria Gmbh
00D027 Applied Automation
00D028 Omneon Video Networks
00D029 Wakefern Food
00D02A Voxent Systems
00D02B Jetcell
00D02C Campbell Scientific
00D02D Ademco
00D02E Communication Automation
00D02F Vlsi Technology
00D030 Safetran Systems
00D031 Industrial Logic
00D032 Yano Electric CO.
00D033 Dalian Daxian Network
00D034 Ormec Systems
00D035 Behavior TECH. Computer
00D036 Technology Atlanta
00D037 Philips-dvs-lo BDR
00D038 Fivemere
00D039 Utilicom
00D03A Zoneworx
00D03B Vision Products
00D03C Vieo
00D03D Galileo Technology
00D03E Rocketchips
00D03F American Communication
00D040 Sysmate CO.
00D041 Amigo Technology CO.
00D042 Mahlo Gmbh & CO. UG
00D043 Zonal Retail Data Systems
00D044 Alidian Networks
00D045 Kvaser AB
00D046 Dolby Laboratories
00D047 XN Technologies
00D048 Ecton
00D049 Impresstek CO.
00D04A Presence Technology Gmbh
00D04B LA CIE Group S.A.
00D04C Eurotel Telecom
00D04D DIV OF Research & Statistics
00D04E Logibag
00D04F Bitronics
00D050 Iskratel
00D051 O2 Micro
00D052 Ascend Communications
00D053 Connected Systems
00D054 SAS Institute
00D055 Kathrein-werke KG
00D056 Somat
00D057 Ultrak
00D058 Cisco Systems
00D059 Ambit Microsystems
00D05A Symbionics
00D05B Acroloop Motion Control
00D05C Technotrend Systemtechnik Gmbh
00D05D Intelliworxx
00D05E Stratabeam Technology
00D05F Valcom
00D060 Panasonic European
00D061 Tremon Enterprises CO.
00D062 Digigram
00D063 Cisco Systems
00D064 Multitel
00D065 Toko Electric
00D066 Wintriss Engineering
00D067 Campio Communications
00D068 Iwill
00D069 Technologic Systems
00D06A Linkup Systems
00D06B SR Telecom
00D06C Sharewave
00D06D Acrison
00D06E Trendview Recorders
00D06F KMC Controls
00D070 Long Well Electronics
00D071 Echelon
00D072 Broadlogic
00D073 ACN Advanced Communications
00D074 Taqua Systems
00D075 Alaris Medical Systems
00D076 Merrill Lynch & CO.
00D077 Lucent Technologies
00D078 Eltex OF Sweden AB
00D079 Cisco Systems
00D07A Amaquest Computer
00D07B Comcam International
00D07C Koyo Electronics Co.
00D07D Cosine Communications
00D07E Keycorp
00D07F Strategy & Technology, Limited
00D080 Exabyte
00D081 Real Time Devices USA
00D082 Iowave
00D083 Invertex
00D084 Nexcomm Systems
00D085 Otis Elevator Company
00D086 Foveon
00D087 Microfirst
00D088 Terayon Communications Systems
00D089 Dynacolor
00D08A Photron USA
00D08B Adva Limited
00D08C Genoa Technology
00D08D Phoenix Group
00D08E Nvision
00D08F Ardent Technologies
00D090 Cisco Systems
00D091 Smartsan Systems
00D092 Glenayre Western Multiplex
00D093 TQ - Components Gmbh
00D094 Timeline Vista
00D095 Alcatel North America ESD
00D096 3com Europe
00D097 Cisco Systems
00D098 Photon Dynamics Canada
00D099 Elcard OY
00D09A Filanet
00D09B Spectel
00D09C Kapadia Communications
00D09D Veris Industries
00D09E 2wire
00D09F Novtek Test Systems
00D0A0 Mips Denmark
00D0A1 Oskar Vierling Gmbh + CO. KG
00D0A2 Integrated Device
00D0A3 Vocal DATA
00D0A4 Alantro Communications
00D0A5 American Arium
00D0A6 Lanbird Technology CO.
00D0A7 Tokyo Sokki Kenkyujo CO.
00D0A8 Network Engines
00D0A9 Shinano Kenshi CO.
00D0AA Chase Communications
00D0AB Deltakabel Telecom CV
00D0AC Grayson Wireless
00D0AD TL Industries
00D0AE Oresis Communications
00D0AF Cutler-hammer
00D0B0 Bitswitch
00D0B1 Omega Electronics SA
00D0B2 Xiotech
00D0B3 DRS Flight Safety AND
00D0B4 Katsujima CO.
00D0B5 IPricot formerly DotCom
00D0B6 Crescent Networks
00D0B7 Intel
00D0B8 Iomega
00D0B9 Microtek International
00D0BA Cisco Systems
00D0BB Cisco Systems
00D0BC Cisco Systems
00D0BD Sican Gmbh
00D0BE Emutec
00D0BF Pivotal Technologies
00D0C0 Cisco Systems
00D0C1 Harmonic Data Systems
00D0C2 Balthazar Technology AB
00D0C3 Vivid Technology PTE
00D0C4 Teratech
00D0C5 Computational Systems
00D0C6 Thomas & Betts
00D0C7 Pathway
00D0C8 I/O Consulting A/S
00D0C9 Advantech CO.
00D0CA Intrinsyc Software
00D0CB Dasan CO.
00D0CC Technologies Lyre
00D0CD Atan Technology
00D0CE Asyst Electronic
00D0CF Moreton BAY
00D0D0 Zhongxing Telecom
00D0D1 Sirocco Systems
00D0D2 Epilog
00D0D3 Cisco Systems
00D0D4 V-bits
00D0D5 Grundig AG
00D0D6 Aethra Telecomunicazioni
00D0D7 B2C2
00D0D8 3Com
00D0D9 Dedicated Microcomputers
00D0DA Taicom Data Systems CO.
00D0DB Mcquay International
00D0DC Modular Mining Systems
00D0DD Sunrise Telecom
00D0DE Philips Multimedia Network
00D0DF Kuzumi Electronics
00D0E0 Dooin Electronics CO.
00D0E1 Avionitek Israel
00D0E2 MRT Micro
00D0E3 Ele-chem Engineering CO.
00D0E4 Cisco Systems
00D0E5 Solidum Systems
00D0E6 Ibond
00D0E7 Vcon Telecommunication
00D0E8 MAC System CO.
00D0E9 Advantage Century
00D0EA Nextone Communications
00D0EB Lightera Networks
00D0EC Nakayo Telecommunications
00D0ED Xiox
00D0EE Dictaphone
00D0EF IGT
00D0F0 Convision Technology Gmbh
00D0F1 Sega Enterprises
00D0F2 Monterey Networks
00D0F3 Solari DI Udine SPA
00D0F4 Carinthian Tech Institute
00D0F5 Orange Micro
00D0F6 Alcatel Canada
00D0F7 Next Nets
00D0F8 Fujian Star Terminal
00D0F9 Acute Communications
00D0FA Racal Guardata
00D0FB TEK Microsystems, Incorporated
00D0FC Granite Microsystems
00D0FD Optima Tele.com
00D0FE Astral Point
00D0FF Cisco Systems
00DD00 Ungermann-bass
00DD01 Ungermann-bass
00DD02 Ungermann-bass
00DD03 Ungermann-bass
00DD04 Ungermann-bass
00DD05 Ungermann-bass
00DD06 Ungermann-bass
00DD07 Ungermann-bass
00DD08 Ungermann-bass
00DD09 Ungermann-bass
00DD0A Ungermann-bass
00DD0B Ungermann-bass
00DD0C Ungermann-bass
00DD0D Ungermann-bass
00DD0E Ungermann-bass
00DD0F Ungermann-bass
00E000 Fujitsu
00E001 Strand Lighting Limited
00E002 Crossroads Systems
00E003 Nokia Wireless Business Commun
00E004 Pmc-sierra
00E005 Technical
00E006 Silicon Integrated SYS.
00E007 Network Alchemy
00E008 Amazing Controls!
00E009 Marathon Technologies
00E00A DIBA
00E00B Rooftop Communications
00E00C Motorola
00E00D Radiant Systems
00E00E Avalon Imaging Systems
00E00F Shanghai Baud Data
00E010 Hess Sb-automatenbau Gmbh
00E011 Uniden SAN Diego R&D Center
00E012 Pluto Technologies International
00E013 Eastern Electronic CO.
00E014 Cisco Systems
00E015 Heiwa
00E016 Rapid City Communications
00E017 Exxact Gmbh
00E018 Asustek Computer
00E019 ING. Giordano Elettronica
00E01A Comtec Systems. CO.
00E01B Sphere Communications
00E01C Mobility Electronicsy
00E01D Webtv Networks
00E01E Cisco Systems
00E01F Avidia Systems
00E020 Tecnomen OY
00E021 Freegate
00E022 Analog Devices
00E023 Telrad
00E024 Gadzoox Networks
00E025 dit CO.
00E026 Redlake Masd
00E027 DUX
00E028 Aptix
00E029 Standard Microsystems
00E02A Tandberg Television AS
00E02B Extreme Networks
00E02C AST Computer
00E02D InnoMediaLogic
00E02E SPC Electronics
00E02F Mcns Holdings
00E030 Melita International
00E031 Hagiwara Electric CO.
00E032 Misys Financial Systems
00E033 E.E.P.D. GmbH
00E034 Cisco Systems
00E035 Loughborough Sound Images
00E036 Pioneer
00E037 Century
00E038 Proxima
00E039 Paradyne
00E03A Cabletron Systems
00E03B Prominet
00E03C AdvanSys
00E03D Focon Electronic Systems A/S
00E03E Alfatech
00E03F Jaton
00E040 DeskStation Technology
00E041 Cspi
00E042 Pacom Systems
00E043 VitalCom
00E044 Lsics
00E045 Touchwave
00E046 Bently Nevada
00E047 Infocus Systems
00E048 SDL Communications
00E049 Microwi Electronic Gmbh
00E04A Enhanced Messaging Systems
00E04B Jump Industrielle Computertechnik Gmbh
00E04C Realtek Semiconductor
00E04D Internet Initiative Japan
00E04E Sanyo Denki CO.
00E04F Cisco Systems
00E050 Executone Information Systems
00E051 Talx
00E052 Foundry Networks
00E053 Cellport LABS
00E054 Kodai Hitec CO.
00E055 Ingenieria Electronica Comercial Inelcom S.A.
00E056 Holontech
00E057 HAN Microtelecom. CO.
00E058 Phase ONE Denmark A/S
00E059 Controlled Environments
00E05A Galea Network Security
00E05B West END Systems
00E05C Matsushita Kotobuki Electronics Industries
00E05D Unitec CO.
00E05E Japan Aviation Electronics Industry
00E05F e-Net
00E060 Sherwood
00E061 EdgePoint Networks
00E062 Host Engineering
00E063 Cabletron - Yago Systems
00E064 Samsung Electronics
00E065 Optical Access International
00E066 ProMax Systems
00E067 eac Automation-consulting Gmbh
00E068 Merrimac Systems
00E069 Jaycor
00E06A Kapsch AG
00E06B W&G Special Products
00E06C AEP Systems International
00E06D Compuware
00E06E FAR Systems S.p.a.
00E06F Terayon Communications Systems
00E070 DH Technology
00E071 Epis Microcomputer
00E072 Lynk
00E073 National Amusement Network
00E074 Tiernan Communications
00E075 Verilink
00E076 Development Concepts
00E077 Webgear
00E078 Berkeley Networks
00E079 A.t.n.r.
00E07A Mikrodidakt AB
00E07B BAY Networks
00E07C Mettler-toledo
00E07D Netronix
00E07E Walt Disney Imagineering
00E07F Logististem S.r.l.
00E080 Control Resources
00E081 Tyan Computer
00E082 Anerma
00E083 Jato Technologies
00E084 Compulite R&D
00E085 Global Maintech
00E086 Cybex Computer Products
00E087 LeCroy - Networking Productions Division
00E088 LTX
00E089 ION Networks
00E08A GEC Avery
00E08B QLogic
00E08C Neoparadigm LABS
00E08D Pressure Systems
00E08E Utstarcom
00E08F Cisco Systems
00E090 Beckman LAB. Automation DIV.
00E091 LG Electronics
00E092 Admtek Incorporated
00E093 Ackfin Networks
00E094 Osai SRL
00E095 Advanced-vision Technolgies
00E096 Shimadzu
00E097 Carrier Access
00E098 AboCom Systems
00E099 Samson AG
00E09A Positron Industries
00E09B Engage Networks
00E09C MII
00E09D Sarnoff
00E09E Quantum
00E09F Pixel Vision
00E0A0 Wiltron CO.
00E0A1 Hima Paul Hildebrandt Gmbh Co. KG
00E0A2 Microslate
00E0A3 Cisco Systems
00E0A4 Esaote S.p.a.
00E0A5 ComCore Semiconductor
00E0A6 Telogy Networks
00E0A7 IPC Information Systems
00E0A8 SAT GmbH & Co.
00E0A9 Funai Electric CO.
00E0AA Electrosonic
00E0AB Dimat S.A.
00E0AC Midsco
00E0AD EES Technology
00E0AE Xaqti
00E0AF General Dynamics Information Systems
00E0B0 Cisco Systems
00E0B1 Alcatel North America ESD
00E0B2 Telmax Communications
00E0B3 EtherWAN Systems
00E0B4 Techno Scope CO.
00E0B5 Ardent Communications
00E0B6 Entrada Networks
00E0B7 PI Group
00E0B8 Gateway 2000
00E0B9 Byas Systems
00E0BA Berghof Automationstechnik Gmbh
00E0BB NBX
00E0BC Symon Communications
00E0BD Interface Systems
00E0BE Genroco International
00E0BF Torrent Networking Technologies
00E0C0 Seiwa Electric MFG. CO.
00E0C1 Memorex Telex Japan
00E0C2 Necsy S.p.a.
00E0C3 Sakai System Development
00E0C4 Horner Electric
00E0C5 Bcom Electronics
00E0C6 Link2it, L.l.c.
00E0C7 Eurotech SRL
00E0C8 Virtual Access
00E0C9 AutomatedLogic
00E0CA Best Data Products
00E0CB Reson
00E0CC Hero Systems
00E0CD Sensis
00E0CE ARN
00E0CF Integrated Device Technology
00E0D0 Netspeed
00E0D1 Telsis Limited
00E0D2 Versanet Communications
00E0D3 Datentechnik Gmbh
00E0D4 Excellent Computer
00E0D5 Arcxel Technologies
00E0D6 Computer & Communication Research LAB.
00E0D7 Sunshine Electronics
00E0D8 Lanbit Computer
00E0D9 Tazmo CO.
00E0DA Alcatel North America ESD
00E0DB ViaVideo Communications
00E0DC Nexware
00E0DD Zenith Electronics
00E0DE Datax NV
00E0DF KE Kommunikations-electronik
00E0E0 SI Electronics
00E0E1 G2 Networks
00E0E2 Innova
00E0E3 Sk-elektronik Gmbh
00E0E4 Fanuc Robotics North America
00E0E5 Cinco Networks
00E0E6 Incaa Datacom B.V.
00E0E7 Raytheon E-systems
00E0E8 Gretacoder Data Systems AG
00E0E9 Data LABS
00E0EA Innovat Communications
00E0EB Digicom Systems, Incorporated
00E0EC Celestica
00E0ED Silicom
00E0EE Marel HF
00E0EF Dionex
00E0F0 Abler Technology
00E0F1 That
00E0F2 Arlotto Comnet
00E0F3 WebSprint Communications
00E0F4 Inside Technology A/S
00E0F5 Teles AG
00E0F6 Decision Europe
00E0F7 Cisco Systems
00E0F8 Dicna Control AB
00E0F9 Cisco Systems
00E0FA TRL Technology
00E0FB Leightronix
00E0FC Huawei Technologies CO.
00E0FD A-trend Technology CO.
00E0FE Cisco Systems
00E0FF Security Dynamics Technologies
00E6D3 Nixdorf Computer
020701 Racal-datacom
021C7C Perq Systems
026086 Logic Replacement TECH.
02608C 3com
027001 Racal-datacom
0270B0 M/a-com Companies
0270B3 Data Recall
029D8E Cardiac Recorders
02AA3C Olivetti Telecomm SPA (olteco)
02BB01 Octothorpe
02C08C 3com
02CF1C Communication Machinery
02E6D3 Nixdorf Computer
040AE0 Xmit AG Computer Networks
04E0C4 Triumph-adler AG
080001 Computervision
080002 Bridge Communications
080003 Advanced Computer COMM.
080004 Cromemco Incorporated
080005 Symbolics
080006 Siemens AG
080007 Apple Computer
080008 Bolt Beranek AND Newman
080009 Hewlett Packard
08000A Nestar Systems Incorporated
08000B Unisys
08000C Miklyn Development CO.
08000D International Computers
08000E NCR
08000F Mitel
080011 Tektronix
080012 Bell Atlantic Integrated SYST.
080013 Exxon
080014 Excelan
080015 STC Business Systems
080016 Barrister Info SYS
080017 National Semiconductor
080018 Pirelli Focom Networks
080019 General Electric
08001A Tiara/ 10net
08001B Data General
08001C Kdd-kokusai Debnsin Denwa CO.
08001D Able Communications
08001E Apollo Computer
08001F Sharp
080020 SUN Microsystems
080021 3M Company
080022 NBI
080023 Panasonic Communications Co.
080024 10net Communications/dca
080025 Control Data
080026 Norsk Data A.S.
080027 Cadmus Computer Systems
080028 Texas Instruments
080029 Megatek
08002A Mosaic Technologies
08002B Digital Equipment
08002C Britton LEE
08002D Lan-tec
08002E Metaphor Computer Systems
08002F Prime Computer
080030 Network Research
080030 Cern
080030 Royal Melbourne Inst OF Tech
080031 Little Machines
080032 Tigan Incorporated
080033 Bausch & Lomb
080034 Filenet
080035 Microfive
080036 Intergraph
080037 Fuji-xerox CO.
080038 CII Honeywell Bull
080039 Spider Systems Limited
08003A Orcatech
08003B Torus Systems Limited
08003C Schlumberger Well Services
08003D Cadnetix Corporations
08003E Codex
08003F Fred Koschara Enterprises
080040 Ferranti Computer SYS. Limited
080041 Racal-milgo Information SYS..
080042 Japan Macnics
080043 Pixel Computer
080044 David Systems
080045 Concurrent Computer
080046 Sony
080047 Sequent Computer Systems
080048 Eurotherm Gauging Systems
080049 Univation
08004A Banyan Systems
08004B Planning Research
08004C Hydra Computer Systems
08004D Corvus Systems
08004E 3com Europe
08004F Cygnet Systems
080050 Daisy Systems
080051 Experdata
080052 Insystec
080053 Middle East TECH. University
080055 Stanford Telecomm.
080056 Stanford Linear Accel. Center
080057 Evans & Sutherland
080058 Systems Concepts
080059 A/S Mycron
08005A IBM
08005B VTA Technologies
08005C Four Phase Systems
08005D Gould
08005E Counterpoint Computer
08005F Saber Technology
080060 Industrial Networking
080061 Jarogate
080062 General Dynamics
080063 Plessey
080064 Autophon AG
080065 Genrad
080066 Agfa
080067 Comdesign
080068 Ridge Computers
080069 Silicon Graphics
08006A ATT Bell Laboratories
08006B Accel Technologies
08006C Suntek Technology Int'l
08006D Whitechapel Computer Works
08006E Masscomp
08006F Philips Apeldoorn B.V.
080070 Mitsubishi Electric
080071 Matra (dsie)
080072 Xerox Univ Grant Program
080073 Tecmar
080074 Casio Computer CO.
080075 Dansk Data Electronik
080076 PC LAN Technologies
080077 TSL Communications
080078 Accell
080079 THE Droid Works
08007A Indata
08007B Sanyo Electric CO.
08007C Vitalink Communications
08007E Amalgamated Wireless(aus)
08007F Carnegie-mellon University
080080 AES Data
080081 ,astech
080082 Veritas Software
080083 Seiko Instruments
080084 Tomen Electronics
080085 Elxsi
080086 Konica Minolta Holdings
080087 Xyplex
080088 Mcdata
080089 Kinetics
08008A Performance Technology
08008B Pyramid Technology
08008C Network Research
08008D Xyvision
08008E Tandem Computers
08008F Chipcom
080090 Sonoma Systems
081443 Unibrain S.A.
08BBCC Ak-nord EDV Vertriebsges. mbH
100000 Private
10005A IBM
1000E8 National Semiconductor
1100AA Private
800010 ATT Bell Laboratories
A06A00 Verilink
AA0000 Digital Equipment
AA0001 Digital Equipment
AA0002 Digital Equipment
AA0003 Digital Equipment
AA0004 Digital Equipment
ACDE48 Private
525400 QEMU
B0C420 Bochs
  07070100243ff7000081a40000000a0000000a0000000144fe8f26000c5981000000880000000a00000000000000000000002600000005reloc/share/nmap/nmap-os-fingerprints # Nmap OS Fingerprint List. -*- mode: fundamental; -*-
# $Id: nmap-os-fingerprints 3408 2006-05-31 23:01:19Z fyodor $ 
#
# Contributions to this database are welcome.  If Nmap obtains a new
# fingerprint (and test conditions are favorable), it will print out a
# URL you can use to submit the fingerprint.  If Nmap guesses wrong,
# please send the full Nmap output and the exact destination host OS
# name and version to fyodor@insecure.org .  Thanks!
#
# By submitting fingerprints you are transfering any and all copyright
# interest in the data to Fyodor so that he can modify it, relicense it,
# incorporate it into programs, etc.
#
# This collection of fingerprint data is (C) 1998-2003 by
# Insecure.Com LLC.  This data is available for
# free use by open source software under the terms of the GNU General
# Public License.  We also license the data to selected
# commercial/proprietary vendors under less restrictive terms.
# Contact sales@insecure.com for more information.
#
# TEST DESCRIPTION:
# Tseq is the TCP sequenceability test
# T1 is a SYN packet with a bunch of TCP options to open port
# T2 is a NULL packet w/options to open port
# T3 is a SYN|FIN|URG|PSH packet w/options to open port
# T4 is an ACK to open port w/options
# T5 is a SYN to closed port w/options
# T6 is an ACK to closed port w/options
# T7 is a FIN|PSH|URG to a closed port w/options
# PU is a UDP packet to a closed port

Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0
Class 2Wire | embedded || WAP
TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com Home Connect Cable Modem external with USB - Model 3CR29223
Fingerprint 3Com Home Connect Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0
Fingerprint 3Com OfficeConnect 812 aDSL router
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint 3Com OfficeConnect Remote 812 aDSL Router
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<C354%SI=<1E)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# 3Com Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604
Fingerprint 3Com Sharkfin/Tailfin Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Sharkfin/Tailfin Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# US Robotics USR8000 Broadband router, firmware 1.27 patched
Fingerprint US Robotics USR8000 Broadband router
Class 3Com | embedded || broadband router
TSeq(Class=RI%gcd=<68%SI=<726%IPID=BI%TS=U)
T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|C00|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com NBX Superstack 3 IP PBX running firmware 4_1_11
# 3Com NBX-100 (version R4_1_4) Phone System Processor
Fingerprint 3Com NBX PBX
Class 3Com | embedded || PBX
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# 3Com AccessBuilder Remote Office 500 with firmware V05.T4N
Fingerprint 3Com AccessBuilder Remote Office 500 router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3
Class 3Com | embedded || router
TSeq(Class=TD%gcd=3C%SI=<FF)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1
Class 3Com | embedded || router
TSeq(Class=TD%gcd=32|64|96%SI=<FF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
Fingerprint 3Com Netbuilder Remote Office 222 router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27
Class 3Com | embedded || router
TSeq(Class=TD%gcd=32|64|96%SI=<F)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# 3Com OfficeConnect Netbuilder router running 11.4.0.09
Fingerprint 3Com OfficeConnect Netbuilder router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3com OfficeConnect Remote 812 ADSL Router (Firmware V1.1.7)
Fingerprint 3com OfficeConnect Remote 812 ADSL Router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R
Class 3Com | embedded || switch
TSeq(Class=C|TD%gcd=3D090%SI=0)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3com Switch 7700 firmware v2.01
# Huawei S6506R routing switch VRP 3.10 release 1009
Fingerprint 3Com 7700/8800 Switch or Huawei S6506R routing switch VRP 3.10
Class 3Com | embedded || switch
Class Huawei | VRP || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1FC4%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint 3Com Access Builder 4000 Switch
Class 3Com | embedded || switch
T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# 3Com LANplex 6004 Extended Switching Software 7.0
Fingerprint 3Com LANplex 6004 switch
Class 3Com | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Switch 1100, 3300
Fingerprint 3Com SuperStack II switch (OS v 2.0)
Class 3Com | embedded || switch
TSeq(Class=C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38
Class 3Com | embedded || switch
TSeq(Class=TD%gcd=<68%SI=<3C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com SuperStack II RAS 1500 software version 2.5.0, 159
Fingerprint 3Com SuperStack II RAS remote access server
Class 3Com | embedded || terminal server
TSeq(Class=TD%gcd=<320CC%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com terminal server ESPL CS2100
Class 3Com | embedded || terminal server
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06
# 3Com 11Mpbs Wireless LAN Access Point 8000
Fingerprint Datavoice 3Com WAP or TxPORT PRISM T1 CSU/DSU
Class 3Com | embedded || WAP
Class Datavoice | embedded || CSUDSU
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Tested ACC Amazon 9.2.29, ACC Congo 9.2.35
Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator
Class ACC | embedded || router
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07)
Class Acorn | RISC OS || general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd)
Class Acorn | RISC OS || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Actiontec Wireless ready DSL Gateway - Model R1520SU
# Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16
Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16
Class Actiontec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=1194%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Adtran Atlas 890 digital cross-connect device
Class Adtran | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Aethra Vega Star Gold (Videoconferencing appliance)
# Aethra Video Conference System Vega Pro S running pSOSystem
Fingerprint Aethra Vega Conference System
Class Aethra | embedded || webcam
TSeq(Class=RI%gcd=<6%SI=<2F97016&>79D33%IPID=I%TS=U)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge
Class Aironet | embedded || bridge
TSeq(Class=C%Val=0)
T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Aironet Wireless Bridge running firmware V5.0J
Class Aironet | embedded || bridge
TSeq(Class=C|TR)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=)
T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps Wireless access point
Class Aironet | embedded || WAP
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Alcatel 1000 ADSL (modem)
Class Alcatel | embedded || broadband router
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel 1000 DSL Router
Class Alcatel | embedded || broadband router
TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Alcatel Speed Touch Home running GV8BAA3.235 (992640)
# Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
#  Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2
Fingerprint Alcatel Speed Touch *DSL modem/router
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E)

# Alcatel Speed Touch 510 *DSL router (uses THOMSON UNIX embedded Version 4.0.0.9.0)
Fingerprint Alcatel Speed Touch 510 *DSL modem/router
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel Speed Touch Pro aDSL modem
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel OmniStack switch version 4.3.3 GA
Class Alcatel | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Alcatel telephone system called OmniPcx 4400 Chorus MiX V.3.2 r4.1.5 COMP-386
Fingerprint Alcatel OmniPcx 4400 telephone system
Class Alcatel | embedded || telecom-misc
TSeq(Class=RI%gcd=<6%SI=<720CE&>AEE%IPID=I%TS=U)
T1(DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Advanced Reflexes IP Phone, Version: E/AT400/46.8
# IBM x450 remote management console (lets you switch machine on/off, check temp, etc)
Fingerprint Alcatel Advanced Reflexes IP Phone or IBM x450 remote management console
Class Alcatel | embedded || VoIP phone
Class IBM | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub
Class Allied Telesyn | embedded || hub
TSeq(Class=C)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA
Class Allied Telesyn | embedded || switch
TSeq(Class=TD%gcd=FA|1F4%SI=<FFF)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Allied Telesyn Layer 3 Switch AT-8748XL Version 2.6.1
# Allied Telesyn Rapier 24i
Fingerprint Allied Telesyn AT-8748XL or Rapier 24i Switch
Class Allied Telesyn | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04
# Ericsson Home internet Solution ver. 2.0
Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0
Class Allied Telesyn | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Amos 2.3A
Class Alpha Micro | AMOS || general purpose
TSeq(Class=i800%gcd=<6%SI=<14)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7
Class Alteon | embedded || load balancer
TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42
Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B
Class Alteon | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=RD)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Alteon AceSwitch 110 (software 4.0.37)
# Centillion C100 ATM Switch OS Version 2.0.2.
Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch
Class Alteon | embedded || switch
Class Cantillion | embedded || switch
TSeq(Class=TD%gcd=<9C8%SI=<1E)
T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Alteon ACEswitch 184 Software Version 8.0.49
Fingerprint Alteon ACEswitch 184 V. 8.0.49
Class Alteon | embedded || switch
TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Amiga OS 3.5 (Miami TCP/IP Stack v3.1)
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 2.1 running AmiTCP4.3
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K%TS=U)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS AmiTCP/IP 4.3
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS AmiTCP/IP Genesis 4.6
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 2.1-3.0
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 3.0
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 3.1-3.2
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint APC MasterSwitch Network Power Controller
Class APC | embedded || power-device
TSeq(Class=TR)
T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint APC Network management Card AP9616
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# APC AP9617  network management card inside Matrix 5000 UPS
Fingerprint APC network-enabled UPS
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# APC UPS Network Management Card, Model AP9617
Fingerprint APC UPS Network Management Card
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# SmartUPS 3000RM Firmware: 92.14.I
# APC PDU AOS v1.1.6
Fingerprint APC UPS system
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<F38C%SI=<DC%IPID=I)
T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# American Power Conversion / Network Management Card AOS v2.5.3 / Symmetra LX 16000 RM / This is a network management interface on a high end UPS
Fingerprint APC UPS System network management card (runs AOS v2.5.3)
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# American Power Conversion Smart-UPS 3000 RM firmware revision 666.5.I
# APC AOS 2.2.7 (on APC AP7901 network management card)
# APC UPS - Symmetra 16000 UPS_IDEN
# APC AP9617 SmartSlot UPS network management card
# APC Network Management Card EX 10/100BaseT (AP9617)
# APC Network Management Card AOS v2.2.7 (Rack PDU APP v2.2.0)
# APC network mgmt card AP9617
Fingerprint APC UPS System network management card (runs AOS)
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<7A124%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=Y|N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint APC Web/SNMP UPS management card
Class APC | embedded || power-device
TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)
T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Apollo Domain/OS SR10.3.5
Class Apollo | Domain/OS || general purpose
TSeq(Class=RI|TD%gcd=<E%SI=<898%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Apollo Domain/OS SR10.4
Class Apollo | Domain/OS || general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<FF)
T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2
Class Apple | A/UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)
Class Apple | embedded || printer
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Actually it is not constant seq class -- it just seems that way
# because it takes so long to increment
Fingerprint Apple Color LaserWriter 600 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Color LaserWriter 600 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple LaserWriter 12/640 PS
Class Apple | embedded || printer
TSeq(Class=C%Val=85BD001%IPID=I%TS=U)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# The sequence prediction is never really true random, but sometimes it
# has two unique "tracks" which make it look random to nmap.  Here is a
# real example:  Sequence numbers: 5576001 25D001 5576001 25D001
Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)
Class Apple | embedded || printer
TSeq(Class=TR|C)
T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# Apple AirPort Extreme Base Station Firmware 5.1.1
Fingerprint Apple Airport Extreme Base Station (WAP) or ARRIS Cadant C3 CMTS Cable Modem
Class Apple | embedded || WAP
Class ARRIS | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ)
T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Apple Airport Express (Wireless Router/Bridge) (Firmware v6.1)
# Apple AirPort Express (Apple Base Station V6.0)
# OKI Phaser B6300N laser printer
# Netgear 7000 Series Managed Switch (GSM7324) (strang ops)
# Westel Versalink 327W, Wireless DSL Modem/Router
Fingerprint Embedded device (Apple WAP, Dell bridge, OKI printer, Westel Broadband router)
Class Apple | embedded || WAP
Class Dell | embedded || storage-misc
Class Okidata | embedded || printer
Class Westel | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<A9830&>1000%TS=2HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS X 1.1-1.2
Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<5)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0?
Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4)
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF)
T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(W=2000%ACK=O%Flags=R%Ops=)
T5(W=0%ACK=S++%Flags=AR%Ops=)
T6(W=0%ACK=O%Flags=R%Ops=)
T7(W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1 - 10.1.4
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1.5
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Mac OS 10.2.6, Darwin kernel 6.6
Fingerprint Apple Mac OS X 10.1.5-10.2.8
Class Apple | Mac OS X | 10.1.X | general purpose
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2?
Fingerprint Apple Mac OS X Server 10.1.2 (ppc)
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177)
T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.6
Class Apple | Mac OS X | 10.2.X | general purpose
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.6 (Jaguar)
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.8 (Jaguar)
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Mac OS X Server 10.2.8 Darwin Kernel 6.8 Macintosh powerpc
Fingerprint Apple Mac OS X Server 10.2.8
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.3.3 (Panther)
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Apple Mac OS 10.3.5 (Darwin Kernel Version 7.5.0)
# Mac OS 10.3.7 Server, Darwain, PPC. Kernel version 7.70. All relevant updates as of 2/2/05
Fingerprint Apple Mac OS X 10.3.5 or 10.3.7
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Darwin 7.7.0 Power Macintosh powerpc, OS X, version 10.3.7
# Apple Mac OS X 10.3.6 (7R28) -  (Darwin 7.6.0)
Fingerprint Apple Mac OS X 10.3.6 or 10.3.7
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.3.9
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=E34E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.4.1 (Tiger)
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=A%Ops=NNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Apple Mac OS X 10.3.8 (Panther); Darwin Kernel Version 7.8.0
# Apple Mac OS X 10.4 (Build: 8A428); Kernel: Darwin 8.0.0
Fingerprint Apple Mac OS X 10.3.8 or 10.4
Class Apple | Mac OS X | 10.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Apple Mac OS X 10.4.0 (Tiger) - Darwin Kernel Version 8.0.0
# Apple Macintosh PowerBook G4 15" Titanium, Mac OS X 10.4.0 (Tiger) build 8A428
# Mac OS X 10.4 Darwin 8.0.0 Darwin Kernel Version 8.0.0: Sat Mar 26 14:15:22 PST 2005;
# Fingerprint Apple Mac OS X 10.4.0 Build 8a428 Darwin Kernel Version 8.0.0. Power Macintosh powerpc Hardware is PB G4
# Darwin 8.1.0 Kernel Version 8.1.0 (Apple Mac OS 10.4.1 Tiger)
Fingerprint Apple Mac OS X 10.4.0 - 10.4.4 (Tiger)
Class Apple | Mac OS X | 10.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6
Class Apple | Mac OS | 7.X | general purpose
TSeq(Class=C|TD)
T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Not really constant -- just slow incrementation
# This is an LCIII
Fingerprint Apple Mac OS 7.1
Class Apple | Mac OS | 7.X | general purpose
TSeq(Class=C)
T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 7.5.5 - 9
Class Apple | Mac OS | 7.X | general purpose
Class Apple | Mac OS | 8.X | general purpose
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8 running on an LC 475
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.0
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0)
T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac)
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.5
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)

# on Macintosh GS server
Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0)
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS 8.6 running WebStar http server
Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

#  Mac OS 9 on a Power Macintosh 7200/75
# iMac running Mac OS 9.1
Fingerprint Apple Mac OS 9 - 9.1
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# HP-UX B.11.00
Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00
Class Apple | Mac OS | 9.X | general purpose
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<9%SI=>3FFF)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 9.2.2
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ)
T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple MacOS 9.2.2
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<32EA6&>111%IPID=I%TS=1000HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0|40%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1
Class Apple | Newton OS || PDA
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=R%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Arescom 800 series dsl router
Class Arescom | embedded || broadband router
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Arescom NetDSL 1000NDS series ADSL router
Class Arescom | embedded || broadband router
TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint ARLAN BR2000E V5.0E Wireless Radio Bridge
Class Arlan | embedded || bridge
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Asante FriendlyNet FR3004 Series Internet Hub
Class Asante | embedded || hub
TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AsanteHub 2072 Ethernet hub
Class Asante | embedded || hub
TSeq(Class=C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante 6524-2G GigE switch
Class Asante | embedded || switch
TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 ))
Class Asante | embedded || switch
TSeq(Class=C%Val=4090000)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante IntraSwitch 5324
Class Asante | embedded || switch
TSeq(Class=C%Val=80000)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch)
Fingerprint Asante IntraSwitch 6216M firmware v2.05A
Class Asante | embedded || switch
TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router
Class Ascend | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U)
T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Max 1800 50Ap8+ or 2024 router
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend P130 Router
Class Ascend | embedded || router
TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Ascend P75 router
Class Ascend | embedded || router
TSeq(Class=RI%gcd=<6%SI=>500&<FFFF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B)
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<FF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50
Class Ascend | embedded || router
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50 rev 4.6C
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710%SI=<5)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50 running 5.1A Firmware
Class Ascend | embedded || router
TSeq(Class=64K)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline P130 or 50
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<BB)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1
Class Ascend | Embedded/OS || router
TSeq(Class=RI%gcd=<5%SI=>600)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS
Fingerprint Ascend / Lucent MAX TNT terminal server
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<14F46&>346)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Ascend Mac 6000 Terminal access server (dialup access server) Running TAOS 9.0.9
# Lucent (Acend) DSLMAX 20 revision 8.0.7
Fingerprint Ascend Mac 6000 Terminal access server
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<919BA&>E5D%IPID=BI%TS=U)
T1(DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Max terminal server firmware 7.0.4
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<14&>1000)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend TNT OS +5.0Ap48+
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=>1000)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MiNT with MiNTnet 1.03 running on Atari TT
Class Atari | Atari || game console
TSeq(Class=TD%gcd=3E7%SI=0)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Atari Mega STE running JIS-68k 3.0
Class Atari | Atari || general purpose
TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86)
T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AtheOS ( www.atheos.cx )
Class AtheOS | AtheOS || general purpose
TSeq(Class=RI%gcd=<8%SI=<A78&>6)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AtheOS/Syllable 0.4.2
Class AtheOS | AtheOS || general purpose
TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Audio Codes MP-104 - VoIP Gateway FXO (version 4.0.282.350)
Fingerprint AudioCodes MP-104 VoIP Gateway FXO
Class AudioCodes | embedded || VoIP gateway
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=20F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=20F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AudioCodes MP-108 FXS (iptele gateway) version: 4.40.162.274
Fingerprint AudioCodes MP-108 VoIP Gateway FXS
Class AudioCodes | embedded || VoIP gateway
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4)
Class Auspex | AuspexOS || fileserver
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Avaya G3 PBX version 8.3
Class Avaya | embedded || PBX
TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Avaya IP Office 403 PBX
Class Avaya | embedded || PBX
TSeq(Class=RI%gcd=<6%SI=<2B46872&>6EC4D%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1111%ACK=S++%Flags=R%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
PU(Resp=N)

# Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022
Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway
Class Avaya | embedded || telecom-misc
TSeq(Class=TD%gcd=<6%SI=<14%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Avocent net KVM switch
Class Avocent | embedded || specialized
TSeq(Class=TR|RI|i800%gcd=<2004%SI=<40D8%IPID=I%TS=1000HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Avocent CPS 1610 serial port server
Class Avocent | embedded || terminal server
TSeq(Class=RI%gcd=<14004%SI=<10C2%IPID=I%TS=1000HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Axent Raptor Firewall running on Windows NT
Class Axent | Windows | NT/2K/XP | firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

# Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
Fingerprint AXIS or Meridian Data Network CD-ROM server
Class AXIS | embedded || fileserver
TSeq(Class=C)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS NetEye Camera Server V1.20
# AXIS NPS 53X Printer Server V4.26 Jul 01 1995
# AXIS StorPoint CD-ROM server V 4.20
# AXIS Camera 200pV1.41
Fingerprint AXIS Stack -- CD-ROM server or print server or camera server
Class AXIS | embedded || fileserver
Class AXIS | embedded || print server
Class AXIS | embedded || webcam
TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS StorPoint CD E100 CD-ROM Server V5.32 Jan 19 2001
Fingerprint AXIS StorPoint CD E100 CD-ROM Server
Class AXIS | embedded || fileserver
TSeq(Class=TD%gcd=<80004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS StorPoint CD E100 CD-ROM Server V5.20 Oct 27 1999
Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.20
Class AXIS | embedded || fileserver
TSeq(Class=C%Val=4B80000%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS StorPoint CD E100 CD-ROM Server V5.38 Jan 12 2004
Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.38
Class AXIS | embedded || fileserver
TSeq(Class=C%Val=30D40000%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS 540 Ethernet Print Server ver 5.48
Class AXIS | embedded || print server
TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS 540 Print Server
Class AXIS | embedded || print server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS 540/542 print server v5.30 Jan 24 1997
Fingerprint AXIS 540/542 Print Server v5.30
Class AXIS | embedded || print server
TSeq(Class=C)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS Print Server firmware 7.0.2
Class AXIS | embedded || print server
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS 200+ Web Camera running OS v1.42
Class AXIS | embedded || webcam
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)

Fingerprint AXIS 2120 network camera
Class AXIS | embedded || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# AXIS 200+ Webcam running software version is 1.42
Fingerprint AXIS Neteye 200+ Webcam running software version 1.42
Class AXIS | embedded || webcam
TSeq(Class=TD|C%gcd=<80004%SI=<1E%Val=DFB80000%IPID=RD|I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS NetEye Camera Server V1.20
Class AXIS | embedded || webcam
TSeq(Class=C)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS 540+/542+
# AXIS 5400 print server
Fingerprint AXIS Network Print Server
Class AXIS | Linux || print server
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uClinux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/.
Fingerprint AXIS 2100 Network Camera running Linux/CRIS v2.32
Class AXIS | Linux || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Barix Exstreamer network MP3 player
Class Barix | embedded || media device
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99)
# Bay Networks ASN Processor revision 9, SE100NM and SFNM modules
Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9
Class Bay Networks | embedded || router
T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bay Networks Instant Internet router
Class Bay Networks | embedded || router
TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB)
T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Bay Networks Instant Internet router
Class Bay Networks | embedded || router
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Baystack Instant Internet 400 SoHo Router
Class Bay Networks | embedded || router
TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bay Networks BayStack 310T switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BayStack 28115/ADV Fast Ethernet Switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint BayStack 450-24T HW:RevL  FW:V1.47 SW:v3.1.0.22  ISVN:1
Fingerprint BayStack 450-24T switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=<1F8%SI=<50%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# BayTech RPC4 with Network Module (Data Switch Series - F3.03 (C)2000 DS72C808 Bay Technical Associates DS72)
# BayTech rpc3-15NC Remote Power Control device
Fingerprint BayTech Remote Power Control RPC3-15NC or RPC4
Class BayTech | embedded || power-device
TSeq(Class=TD|RI%gcd=<C%SI=<4272&>95%IPID=I|RD%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=ARF%Ops=)
T3(Resp=N)
T4(DF=N%W=800|1000%ACK=S%Flags=ARF%Ops=)
T5(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BBIagent v1.8.1 software router
Class BBIagent | Linux | 2.4.X | software router
TSeq(Class=RI%gcd=<6%SI=<18C54&>3B8%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Running on a BeBox 66Mhz
Fingerprint BeOS 4 - 4.5
Class Be | BeOS | 4.X | general purpose
TSeq(Class=TD%gcd=1%SI=0)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a)
Class Be | BeOS | 5.X | general purpose
TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.03 x86 with the BONE network stack
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<141E&>1F%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.1d0/DANO on x86
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS R5.03 Personal Edition
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# IPC@CHIP (SC12) -@CHIP-RTOS version SC12 V1.10 Beta Test version MEDIUMBuild: Nov 26 2003
Fingerprint IPC@CHIP CHIP-RTOS version SC12
Class Beck-IPC | embedded || specialized
TSeq(Class=TD%gcd=<C354%SI=<28%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Belkin DSL/Cable Router running firmware v1.03.08
Fingerprint Belkin DSL/Cable Router
Class Belkin | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Plan9 x86 (2004.11.06)
# Plan 9 4th edition on x86
Fingerprint Bell Labs Plan9 Fourth Edition
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Bell Labs Plan9 Fourth Edition (x86)
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bell Labs Plan9 Second Edition
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BenQ Wireless Lan Router AWL700
Class BenQ | embedded || WAP
TSeq(Class=TD%gcd=<34%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Billion ADSL Router BIPAC 711CE
Fingerprint Billion ADSL router
Class Billion | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<1315F78&>306D3%IPID=Z)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Billion BIPAC-741GE V2 ADSL Router/Modem - Firmware 4.55 (HW: Helium 210-80 ADSL GE-A v1.00)
Fingerprint Billion BIPAC-741GE V2 aDSL Router
Class Billion | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<DF2A&>137%IPID=I%TS=U)
T1(DF=Y%W=1194%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=Y%W=1194%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=Y%W=1194%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# BIANCA/BRICK-XS version V.6.2 Rev. 5 from 2003/05/26 00:00:00
Fingerprint BinTEC BIANCA/BRIK-XS Broadband router V. 6.X
Class BinTec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<54E5C&>C09%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# BINTEC-X4000 version V.7.1 Rev. 4 (Patch 3) IPSec
# BinTec BingoDSL Router Firmware version 7.1 Rev.1 Patch 11
Fingerprint BinTec BingoDSL/X4000 Router Firmware V. 7.1
Class BinTec | embedded || broadband router
TSeq(Class=RI%gcd=<8%SI=<240E&>1A%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# XS SW Release 4.9.1 ISDN access router
# BinTec BIANCA XM OS version 4.93
Fingerprint BinTec XS/XM ISDN access router V. 4.9.1-4.9.3
Class BinTec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=>FF&<FFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# VPN Access 25 version V.7.1 Rev. 12
Fingerprint VPN Access 25 version V. 7.1
Class BinTec | embedded || broadband router
TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Blue Coat Security Proxy Appliance
Class Blue Coat | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<A4704&>780%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Blue Coat SG6000 Series - SGOS 3.2.2.1
Fingerprint Blue Coat ProxySG (SGOS 3.2.2.1)
Class Blue Coat | SGOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<43F10C&>4CBD%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Blue Coat SGOS 2.0.09 (Release ID: 20047)
# Blue Coat SGOS 3.0.1.0 (Release ID: 20069)
Fingerprint Blue Coat Secure Gateway
Class Blue Coat | SGOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<15654E&>1CC9%IPID=I%TS=2HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BlueCoat SG4
Class Blue Coat | SGOS || web proxy
T1(DF=N%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MENWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Borderware 5.0 Firewall
Class Borderware | embedded || firewall
TSeq(Class=TR|RI%gcd=<204%SI=<14)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Borderware 5.2 firewall
Class Borderware | embedded || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=N)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Borderware 6.0.2 firewall
Class Borderware | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Bosch Security Systems's Divar Digital Video Recorder Version 2.00
Class Bosch | embedded || webcam
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BreezeCOM BreezeACCESS Wireless bridge
Class BreezeCOM | embedded || bridge
TSeq(Class=RI%gcd=<6%SI=<988&>4%IPID=I%TS=U)
T1(DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.brixnetworks.com/products/brix1000.html
Fingerprint Brix 1000 Verifier
Class Brix Networks | embedded || specialized
TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Brother Laser Printer HL 1230
Fingerprint Brother HL-1230 Printer
Class Brother | embedded || printer
TSeq(Class=TD%gcd=<DC004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Brother HL-2070N Printer Firmware Ver.1.03 (04.11.18)
Fingerprint Brother HL-2070N Printer
Class Brother | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<1C67888&>48B5D%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 2.0 - 2.1
Class BSDI | BSD/OS | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD)
Class BSDI | BSD/OS | 3.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.0-4.0.1
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<A%SI=<1974A&>16F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.0.1
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.2
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<F3E94&>1A4F%IPID=I%TS=2HZ)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cabletron Smart Switch Router 8600
Class Cabletron | embedded || router
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16
Class Cabletron | embedded || router
TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Cabletron SmartSwitch, Hardware Revision: 00R, Firmware Revision: 05.00.48, BOOTPROM Revision: 02.02.00
Fingerprint Cabletron SmartSwitch
Class Cabletron | embedded || switch
TSeq(Class=TD%gcd=<180004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Cabletron Switch model 6H202-24 Module Hardware Revision: 00A Module Firmware Revision: 05.05.11 Module BootPROM Revision: +03.06.04
Fingerprint Cabletron switch
Class Cabletron | embedded || switch
TSeq(Class=RI|TD%gcd=<404%SI=<263E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# (rel. ID: 17908)
Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# CacheFlow CacheOS (CacheFlow 500-5000 web cache) CFOS 2.1.08 - 2.2.1
Fingerprint CacheFlow CacheOS (web proxy cache) CFOS 2.1.08 - 2.2.1
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheOS (CacheFlow 2000 proxy cache)
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<5%SI=>1111)
T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon GP 160 PF printer
Class Canon | embedded || printer
TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Canon iR 2200 printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Canon Image Runner C3200
Fingerprint Canon iR C3200 printer
Class Canon | embedded || printer
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Canon imageRunner iR2270 printer
Fingerprint Canon iR2270 printer
Class Canon | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<977D4&>5EC%IPID=I%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon iR6000 printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon iR7200 Printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon photocopier/fax/scanner/printer GP30F
Class Canon | embedded || printer
TSeq(Class=TD%gcd=600%SI=0)
T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Canon inkjet printer iP4000R with Wireless interface
Fingerprint Canon Pixmar IP4000R printer
Class Canon | embedded || printer
TSeq(Class=TD%gcd=<20004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++|O%Flags=AS|A%Ops=M|)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Capellix 3000 Modular SAN Switch
Class Capellix | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router
Class CastleNet | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.cayman.com/
Fingerprint Cayman 2E DSL/CABLE router
Class Cayman | embedded || broadband router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cayman 3000 DSL Router
Class Cayman | embedded || broadband router
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Netopia Cayman 3346 DSL router
Class Cayman | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Chase IOLan Terminal Server
Class Chase | embedded || terminal server
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(Resp=N)

#  Chase/Perle IOLAN Terminal Server v3.5.02 CDi
Fingerprint Chase/Perle IOLAN Terminal Server
Class Chase | embedded || terminal server
TSeq(Class=TD%gcd=<84%SI=<1E)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed
# that test
Fingerprint Chase/Perle IOLAN terminal server
Class Chase | embedded || terminal server
TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.2 Running Checkpoint Firewall-1
# IPSO 3.5-FCS8 releng 1020  Running Checkpoint FW-1 NG FP2
Fingerprint Nokia IPSO 3.2-3.5 Running Checkpoint Firewall-1 or NG FP2
Class Checkpoint | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<E4656&>2476)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)

# Nokia IPSO 3.2-3.2.1 releng 783-849
# IPSO 3.4-FCS4A releng 767  Running CheckPoint 4.1 SP6
# Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based)
# Nokia IPSO 4.3.1-FCS5
Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1
Class Checkpoint | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.6 FCS 6 releng 1061  01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplemental
Fingerprint Nokia IPSO 3.6 running CheckPoint FW-1 NG FP2
Class Checkpoint | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Checkpoint Firewall-1 NG on Sun Solaris 8
Class Checkpoint | Solaris | 8 | firewall
TSeq(Class=RI%gcd=<6%SI=<6C82C&>E51%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build)
Class Checkpoint | Windows | NT/2K/XP | firewall
TSeq(Class=RI%gcd=<6%SI=<18358&>3CB)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Checkpoint Firewall-1 on Windows NT 4.0 Server SP4-SP5
Class Checkpoint | Windows | NT/2K/XP | firewall
TSeq(Class=TD%gcd=<8%SI=<154)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Checkpoint Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3
Fingerprint Checkpoint SecurePlatform NG FP3
Class Checkpoint | Windows | NT/2K/XP | firewall
TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CacheOS (1.1.0)
Class Cisco | CacheOS || web proxy
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco 675 DSL router -- cbos 2.1
Class Cisco | CBOS || broadband router
T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M)
T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco ACNS 5.1 Content Engine
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<BFC80E&>1EAE1%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Content Engine 505 Software V. 4.2.1
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# running Application and Content Networking System Software 4.2.3
# Fingerprint Cisco Content Engine 560 Software V. 4.2.3
Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Application and Content Networking System Software Release 5.3.1 (build b5 Mar 17 2005)
Fingerprint Cisco Content Engine ACNSS V5.2.1 or V5.3.1
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<1A91BDA&>44018%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Accesspoint 1200
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AIR-WGB340 V8.38 Workgroup Bridge 340
Fingerprint Cisco AIR-WGB340 V8.38 Wireless workgroup bridge 340
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco WGB350 Wireless WorkGroup Bridge
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub
Class Cisco | embedded || broadband router
Class IBM | embedded || hub
TSeq(Class=TD|i800%gcd=<14004%SI=<14)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1)
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 766 non-IOS software 4.2(3.5)
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=82000%SI=<F)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Soho 97 router running IOS 12.3(8)
Class Cisco | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR|BAR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 3000 Series VPN Concentrator
Class Cisco | embedded || encryption accelerator
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Cisco VPN 3005 running 4.1.2   
# Cisco VPN Series 3000 Concentrator running OS version 4.1.2
# Cisco VPN Concentrator running IOS 4.1.7
Fingerprint Cisco 3000 Series VPN concentrator (OS ver 4.1.x)
Class Cisco | embedded || encryption accelerator
TSeq(Class=RI%gcd=<6%SI=<306F34E&>29F4D%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com 4924 gigabit switch ver 2.04
# Cisco VPN 3000 3.5
Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch
Class Cisco | embedded || encryption accelerator
Class 3Com | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CSS 11501 Content Services Switch
Class Cisco | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco CSS 11501 Content Services Switch
Class Cisco | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<159FA&>235%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco Local Director 420 version 2.1.1
Class Cisco | embedded || load balancer
TSeq(Class=C)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

# The "True Random" is bogus, it is because of sequences
# from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
# Cisco Localdirector 430, running OS 2.1
Fingerprint Cisco Localdirector load balancer
Class Cisco | embedded || load balancer
TSeq(Class=TR|C)
T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# LocalDirector 430 Version 4.2.4
Fingerprint Cisco LocalDirector load balancer
Class Cisco | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<2F240C&>789A%IPID=BI%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco Router C2600 running IOS 12.2(2)T
Class Cisco | embedded || router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4)
Class Cisco | embedded || router
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1548M 10/100 Managed Switch (Firmware Version: v1.03.02)
Fingerprint Cisco 1548M managed switch
Class Cisco | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch,  or Netopia DSL/ISDN router
Class Cisco | embedded || switch
Class Bay Networks | embedded || switch
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<6000%SI=<1E)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 2820 switch Management Console
Class Cisco | embedded || switch
TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5)
# Cisco Catalyst 5500 with OS Version 6.3(5)
# Alcatel OmniSwitch/Router! Version 4.3.1 GA
Fingerprint Cisco Catalyst 5500/6500 or Alcatel OmniSwitch/Router
Class Cisco | embedded || switch
Class Alcatel | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Cisco 6509 Cisco Internetwork Operating System Software IOS Version 12.1(23)E
Fingerprint Cisco Catalyst 6509 switch running IOS Version 12.1(23)E
Class Cisco | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL|MENN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MNW|MW|ML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco Catalyst switch
Class Cisco | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or
# Trancell WebRamp router or Xylan OmniSwitch 3.2.X.X - 3.4.X.X
# Epson Stylus Color 1520C with 100BTX-NIC from Epson
# Cisco 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX
# SonicWall firewall appliance 10meg firmware 3.3.1
Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/Cisco 6509/Trancell Webramp/Xylan OmniSwitch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWall firewall appliance 3.3.1)
Class Cisco | embedded || switch
Class Xylan | embedded || switch
Class Epson | embedded || printer
Class SonicWall | SonicOS || firewall
Class Trancell | embedded || router
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco AS5200 terminal server
Class Cisco | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# A Cisco ATA 186 is a little box that allows a standard POTS
# telephone to be used as a voice-over-IP phone.  There is a
# variation, the ATA 188 that has a pass-through port, much like the
# Cisco 7960 phone.
Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
Class Cisco | embedded || VoIP adapter
TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
Class Cisco | embedded || VoIP adapter
T1(Resp=N)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 7960 SIP Phone running OS 4.2
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<2A004%SI=<28%IPID=I%TS=U)
T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IP phone (POS3-04-3-00, PC030301)
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco IP Phone - Model NumberCP-7940G
# Cisco IP Phone 7940 Series CP-7940G
Fingerprint Cisco IP Phone 7940
Class Cisco | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IP Phone 7960
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<2A004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=578%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=578%ACK=S%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco IP Phone CP-7970G
# Cisco IP Phone 7970G running firmware 6.0.3sr1
Fingerprint Cisco IP Phone 7970G
Class Cisco | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=2000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco ATA 186 (analog telephone adaptor (VoIP)) firmware Rev. B0
# Cisco (Komodo) ATA-186 Version: v2.16 ata18x (Build 030401a)
# Cisco ATA 186 or 7905 VoIP Phone
# Cisco IP Phone 7905 Software Version 1.02.00
# Cisco IP Phone 7912 - Software Version 1.02.02(031217B) - Product ID CP-7912G
# Cisco VoIP Phone (commonly used by Vonage)
# Cisco CP-7912G IP Phone
Fingerprint Cisco VoIP Phone 7905/7912 or ATA 186 Analog Telephone Adapter
Class Cisco | embedded || VoIP phone
Class Cisco | embedded || VoIP adapter
TSeq(Class=TD%gcd=<28004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Cache Engine Web Proxy
Class Cisco | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Cisco 2501, 2504, 4500
Fingerprint Cisco 2501/2504/4500 router with IOS Version 10.3(15) - 11.1(20)
Class Cisco | IOS | 10.X | router
Class Cisco | IOS | 11.X | router
TSeq(Class=RI|TD%gcd=<6%SI=<2000)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<6%SI=<11170)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DECBrouter90T1 Runs Cisco IOS 10.2(5)
# Cisco 1601, IOS 11.0
Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5))
Class Cisco | IOS | 11.X | router
Class DEC | IOS | 10.X | router
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 4500 router running IOS 11.2(2)
Class Cisco | IOS | 11.X | router
T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus
Class Cisco | IOS | 11.X | router
TSeq(Class=RI|TD%gcd=1%SI=<FFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 7206 router (IOS 11.1(17)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<6%SI=>666)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 7206 running IOS 11.1(24)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC)
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 11.3 - 12.0(11)
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<6)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<4%SI=<999&>CC)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 25XX/45XX router, 29XX switch, RSP2 processor
Fingerprint Cisco Router/Switch with IOS 11.2
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 11.X | switch
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX]
# Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6
Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10)
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 11.X | switch
TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1)
Class Cisco | IOS | 11.X | terminal server
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 827 ADSL router running IOS 112.2(11)
Class Cisco | IOS | 12.X | broadband router
TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1
Class Cisco | IOS | 12.X | broadband router
TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 1601 router running IOS 12.0(8)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<B4DC&>8A%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1601R router running IOS 12.1(5)
Class Cisco | IOS | 12.X | router
TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1721 Router running IOS 12.3(10)
Fingerprint Cisco 1721 router running IOS 12.3(10)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=O|S++%Flags=A|AS%Ops=|ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 2514 router running IOS 12.0(21)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# CISCO 2600 router running IOS 12.2(3)
Fingerprint Cisco 2600 router running IOS 12.2(3)
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<8%SI=<F302&>249%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# CISCO 2610 router running IOS 12.2(21a)
Fingerprint Cisco 2610 router running IOS 12.2(21a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Cisco 2611 router running IOS 12.0(7)T
Fingerprint Cisco 2611 router running IOS 12.0(7)T
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<C8546&>49%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Cisco 2611 router running IOS 12.2(7a)
Fingerprint Cisco 2611 router running IOS 12.2(7a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IOS (tm) 1600 Software (C1600-K8OSY-M), Version 12.2(15)T9
# Cisco 2620 Router /w IOS 12.2(15)T14
Fingerprint Cisco 2620 router running IOS 12.2(15)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<1938568&>4088D%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 2620 router running IK903S3-M ios ver 12.3(5)
Fingerprint Cisco 2620 router running IOS 12.3(5)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 2620 running IOS 12.2(19a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 3660, IOS 12.0(6r)T
Fingerprint Cisco 3660 running IOS 12.0(6r)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# cisco 3725 IOS (tm) 3700 Software (C3725-IS-M), Version 12.3(6c), RELEASE SOFTWARE (fc1)
Fingerprint Cisco 3725 router running IOS 12.3(6c)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 3745 Router running IOS version 12.2(15)T13
Fingerprint Cisco 3745 Router running IOS 12.2(15)T13
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Cisco 4000 series, IOS 4500 Software (C4500-P-m), Version 12.0(10.3)S
Fingerprint Cisco 4000 Series running IOS 12.0(10.3)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI|TD%gcd=<6%SI=<F50%IPID=Z%TS=U)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 7200 router running IOS 12.1(14)E6
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 7200 running IOS 12.4(1a)
Fingerprint Cisco 7200 router running IOS 12.4(1a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=B8%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 7204 IOS (tm) 7200 Software (C7200-IS-M), Version 12.1(19), RELEASE SOFTWARE (fc1)
Fingerprint Cisco 7204 router running IOS 12.1(19)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 7206 router running IOS Version 12.2(13)T8
Fingerprint Cisco 7206 router running IOS 12.2(13)T8
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IOS (tm) C800 Software (C800-Y6-MW), Version 12.0(7)T,  RELEASE SOFTWARE (fc2)
Fingerprint Cisco 800 Series Broadband Routers running IOS 12.0(7)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<8%SI=<1399EE&>3219%IPID=Z%TS=U)
T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 837 router running IOS 12.3(11)T
# Cisco 2811 router running IOS 12.3(8r)T7
Fingerprint Cisco 837 router running IOS 12.3(11)T or Cisco 2811 router running IOS 12.3(8r)T7
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 837 Router IOS version 12.3T(8)
Fingerprint Cisco 837 router running IOS 12.3(8)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AS5350, IOS 12.2(2)XB6
Fingerprint Cisco AS5350 running IOS 12.2(2)XB6
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MEML|MEMWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MML|MMWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco IOS 12.0(16a) Service Provider feature set
# Cisco WS-C3508G-XL running 12.0(5)WC3
Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1700 running IOS 12.0(7)T
Fingerprint Cisco IOS 12.0(7)T (on a 1700 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.1(4) on a 2600 router
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 7507 running 12.2(8)T5
Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set
# Cisco 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1)
# Cisco Aironet 1100/1200/1400 access point running IOS 12.2.15
Fingerprint Cisco router or WAP running IOS 12.2
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 12008 running IOS 12.0(18.6)S1
# Cisco 7206VXR running IOS 12.0(18)S
Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 800 running 12.1(5)
# Cisco 2620 router running IOS 12.1(6)
Fingerprint Cisco router running IOS 12.1
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Cisco 3620 running IOS 12.2.1
# IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1)
Fingerprint Cisco router running IOS 12.1(5)-12.2(7a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 2620, IOS 12.2(6r)
# Found on Cisco 1720/1750/2611/3640/AS5300 routers
Fingerprint Cisco router running IOS 12.1.5-12.2.13a
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco WS-C4006
# Cisco 7120-4T1 ISO 12.2
# CISCO 2950C
# Cisco 3600
Fingerprint Cisco router running IOS 12.2
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 2621 running IOS 12.2.8T
# Cisco SOHO 77 running IOS 12.2(8)T
Fingerprint Cisco router running IOS 12.2(8)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco IOS Software, C1700 Software (C1700-ADVSECURITYK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4)
Fingerprint Cisco router running IOS 12.3(11)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Cisco Router (1760) - IOS (tm) C1700 Software, Version 12.3(6)
# IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(6), RELEASE SOFTWARE (fc3) 
# Cisco 837 router running IOS 12.3.8T3
# CISCO C827 (MPC855T) processor (revision 0x501) with 23552K/1024K bytes of memory.
# Cisco 2611XM router running IOS 12.3(10)
# Cisco 2921XM router running IOS 12.3(6a)
# Cisco 7206VXR running IOS 12.3(6b)
# Cisco 831 running IOS Version 12.3(8)T3
# Cisco 3825 Router, IOS 12.3(11)T3 (C3825-ADVSECURITYK9-M, Version 12.3(11)T3, RELEASE SOFTWARE+(fc4))
Fingerprint Cisco router running IOS 12.3(6) - 12.3(11)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 5200 router IOS v12.0(15)
# Cisco 2924C
Fingerprint Cisco router running IOS v12.0(15)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)XC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) (Cisco SOHO 91 Secure router)
Fingerprint Cisco SOHO 91 secure router running IOS 12.3
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco Lightstream 1010 ATM Switch running IOS (tm) LS1010 WA4-5 Software (LS1010-WP-M), Version 12.1(23)E, RELEASE SOFTWARE (fc2)
# Cisco 6500 switch running IOS 12.1(23)E
Fingerprint Cisco switch running IOS 12.1(23)E
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# router Cisco 3640, IOS 12.2(23a)
Fingerprint router Cisco 3640 running IOS 12.2(23a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco catalyst 2924 running IOS 12.0(5)WC5
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Cisco Catalyst 2924XL-EN running IOS 12.0(5)WC8
Fingerprint Cisco Catalyst 2924XL switch running IOS 12.0(5)
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1)
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco Catalyst 2950 switch,  IOS 12.1(9)EA1
Fingerprint Cisco Catalyst 2950 switch running IOS 12.1(9)EA1 or IOS 12.1(22)EA2
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MEM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8)
Class Cisco | IOS | 12.X | WAP
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AP1220 IOS 12.2(11)JA1
Fingerprint Cisco AP1220 WAP running IOS 12.2(11)
Class Cisco | IOS | 12.X | WAP
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CPA2500 (68030) or 2511 router
Class Cisco | IOS || router
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco uBR 7223 router
Class Cisco | IOS || router
TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2)
Class Cisco | NmpSW || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco PIX 4.2(2) Internal Interface
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 515 firewall running software 4.4(5)
Class Cisco | PIX | 4.X | firewall
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall running PIX 4.1(5)
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C%Val=211E005F)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco Pix Firewall running PIX 4.1.6
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C%Val=71F60191%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800|1000%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|400%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX v4.2 Firewall
Class Cisco | PIX | 4.X | firewall
TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

# Cisco PIX running IOS 6.1(1) - Internal interface
# Cisco PIX 520 firewall running PixOS 6.1(3)
# Secure PIX Firewall Version 5.2(2)
Fingerprint Cisco PIX Firewall (PixOS 5.2 - 6.1)
Class Cisco | PIX | 5.X | firewall
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR|AS%Ops=WNMETL|M)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco Secure PIX Firewall Version 5.0(2)
Class Cisco | PIX | 5.X | firewall
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle
# PIX 506 running PIX IOS 6.2
Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 501 firewall running PIX 6.1(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%IPID=I%TS=U)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 515 or 525 Firewall running 6.1(4) - 6.2(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Cisco PIX 501 Firewall running IOS 6.3(1)
# Cisco PIX Firewall IOS version 6.22
# Cisco PIX 515 version 6.3(1)
# Cisco PIX 501 Firewall running PIXOS 6.3.3
Fingerprint Cisco PIX Firewall running PIX 6.2 - 6.3.3
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=400||800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.1(2)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.2(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 506 Firewall
Class Cisco | PIX || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Sun Remote System Console version 1.12
# Brocade Fibre Switch, Firmware 2.6.0
# Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS)
Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console
Class Cisco | vxworks || WAP
Class Brocade | embedded || switch
Class Sun | embedded || remote management
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Clipcomm CP-100 v1.1.39 (040820)
Fingerprint Clipcomm CP-100 VoIP phone
Class Clipcomm | embedded || VoIP phone
TSeq(Class=TD%gcd=<9B4%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM)
T2(Resp=N)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11
Class Cnet | embedded || broadband router
TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U)
T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2
Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2
Class CNT | embedded || storage-misc
TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense
Class Cobalt | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Commodore 64 with TFE Ethernet Card (Contiki)
Class Commodore | embedded || game console
TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U)
T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack)
Class Commodore | embedded || game console
TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=)
T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=)
T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Compaq Inside Management Board
Class Compaq | embedded || remote management
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Integrated Lights Out remote configuration Board
Class Compaq | embedded || remote management
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ProLiant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002
Fingerprint Compaq ProLiant DL580 Integrated Lights-Out remote configuration board V1.06
Class Compaq | embedded || remote management
TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
T1(DF=N%W=400%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00
# NetGear MR814 WAP
Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814
Class Compaq | embedded || WAP
Class Netgear | embedded || WAP
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Compaq Tru64 UNIX (formerly DIGITAL UNIX) 4.0e
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=C)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX 4.0e
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# OSF1 V4.0 1530 alpha
# Tru64 4.0F (Alpha), Patch Kit 8, Kernel Build 1229
Fingerprint Tru64 UNIX 4.0f - 4.0g
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Compaq Tru64 UNIX 5.0 on AlphaServer
# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2
Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2
Class Compaq | Tru64 UNIX | 5.X | general purpose
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Compaq Tru64 UNIX V5.1B (Rev. 2650)
Fingerprint Compaq Tru64 UNIX V5.1B
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Tru64 UNIX v5.1B: OSF1 V5.1 2650 alpha
Fingerprint HP Tru64 UNIX v5.1B
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/DIGITAL Tru64 UNIX)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<E88&>11)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq T1010 Thin Client Windows CE 2.12
Class Compaq | Windows | PocketPC/CE | terminal
TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5
Class Compatible Systems | embedded || broadband router
TSeq(Class=TD%gcd=388|710|A98%SI=<14)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9
Class Compatible Systems | embedded || broadband router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running
# firmware 4.5 and two IntraPorts running 4.4.02.  I'm told this also
# applies to firmware 4.2 on RISC routers, but I have not checked.
Fingerprint Compatible Systems (RISC Router, IntraPort)
Class Compatible Systems | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<6)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Compex CGX3224 Switch, Firmware version CGX1.53
Fingerprint Compex CGX3224 Switch
Class Compex | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CompUSA Broadband Router
Class CompUSA | embedded || broadband router
TSeq(Class=RI|TR%gcd=<6%SI=<7FCAA42%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=101F%ACK=O%Flags=R%Ops=)
T5(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=101F%ACK=O%Flags=R%Ops=)
T7(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d
Class Computone | embedded || terminal server
TSeq(Class=TD%gcd=40%SI=0)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Conexant ADSL Router Firmware 2.33a (FreeBSD)
Fingerprint Conexant ADSL Router
Class Conexant | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<1B50D00&>45EAE%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) with Conexant-Hasbani CX82xxx_4.1.0.9 firmware running on VxWorks 5.4.2 OS
Fingerprint Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B)
Class Conexant | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Contiki 1.2-devel0 on Ethernut (Atmel AVR ATmega128 with RTL8019as Ethernet chip)
# uIP 0.9 running on a Atmel ATmega16 using a Packet Whacker for ethernet connectivity
Fingerprint Contiki 1.2-devel0 embedded OS on Ethernut card or uIP 0.9 TCP/IP stack
Class Contiki | Contiki || specialized
Class uIP | uIP || specialized
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Convex OS Release 10.1
Class Convex | ConvexOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Convex SPP-UX 5.2.1
Class Convex | SPP-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=)
T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SPP-UX 5.x on a Convex SPP-1600
Class Convex | SPP-UX || general purpose
TSeq(Class=C)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=R%Ops=)
T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP j4813A ProCurve Switch 2524
# Copper Mountain Networks DSL Concentrator
# Compaq Remote Insight Lights-Out remote console card
# 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14
# TrueTime NTS-200 GPS Network Time Server
# Compaq Lights Out Edition firmware v2.41
# 3Com NBX 25 (Phone System) Version: R1_0_3
Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock
Class Copper Mountain | embedded || terminal server
Class 3Com | embedded || WAP
Class 3Com | embedded || telecom-misc
Class TrueTime | embedded || specialized
Class Compaq | embedded || remote management
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Corega BAR SW-4P  [Part number:CG-BARSW4P]
Fingerprint Corega BAR SW-4P Broadband Access Router
Class Corega | embedded || broadband router
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint UNICOS 10.0.0 on Cray 90
Class Cray | UNICOS | 10.X | general purpose
TSeq(Class=RI%gcd=<F%SI=<22222&>2222)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cray UNICOS/mk 8.6
Class Cray | UNICOS | 8.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1
Class Cray | UNICOS || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2
Class Cray | UNICOS || general purpose
TSeq(Class=RI%gcd=<6%SI=>F)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120
Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120
Class Cray | Unisys || general purpose
TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyberguard 4.0 firewall
Class Cyberguard | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Cyberguard Firewall 5.2 on Firestar 500 (proprietary Unixware version)
Fingerprint Cyberguard Firewall 5.2
Class Cyberguard | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<5FE3BC&>A86A%IPID=RD%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O|S++%Flags=R|AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Cyclades PathRouter
Class Cyclades | Cyras || router
TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C)
T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRouter/PC
Class Cyclades | Cyras || router
TSeq(Class=RI|TD%gcd=<618708%SI=<1F343)
T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Cyclades PathRAS Remote Access Server v1.1.7
Class Cyclades | Cyras || terminal server
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRouter V 1.2.4
Class Cyclades | Cyros || router
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12
Class Cyclades | Cyros || terminal server
TSeq(Class=TD%gcd=30C382%SI=<BB)
T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# D-Link Internetwork Operating System Software 2630 Series Software, Version 1.3.1J (FULL), RELEASE SOFTWARE
Fingerprint D-Link 2630 Broadband router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<2DC04%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-713P Wireless router (firmware 2.60 build 6a)
# 704P Ethernet Broadband Gateway
Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP
Class D-Link | embedded || broadband router
TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U)
T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-604 Broadband router
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<68%SI=<13A6&>16%IPID=BI%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-604 Ethernet Broadband Router with firmware V3.01
# D-link 4 port Ethernet Broadband Router DI-604 H/W Ver.:D1 F/W Ver.:3.01
Fingerprint D-Link DI-604 Ethernet Broadband Router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-604 Ethernet router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-701, Version 2.22
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-704P Cable/DSL Residential Gateway firmware version 2.57 build 3
Fingerprint D-Link DI-704P Cable/DSL Residential Gateway
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<68%SI=<1338&>13%IPID=I%TS=U)
T1(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7)
# DI-804 Broadband Router with Firmware 2.01
Fingerprint D-Link DI-804 Cable/DSL Residential Gateway
Class D-Link | embedded || broadband router
TSeq(Class=TD|TR%gcd=<10%SI=<3C%IPID=I%TS=U)
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-804HV 4-Port Broadband VPN Router
# US-Robotics Wireless Router : Revision Number : Model#8022, Version V4.2, CheckSum# B719
Fingerprint D-Link DI-804HV VPN Router or US-Robotics 8022 WAP or DI-714P+ Wireless router
Class D-Link | embedded || broadband router
Class US Robotics | embedded || WAP
TSeq(Class=TD%gcd=<3EC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DSL-300G+ version 7.1.0.30 AnnexA  (Oct 18 2002) R2.05.b4t9uk
Fingerprint D-Link DSL-300G+ DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint D-Link DSL-500 DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DSL-500 DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# D-Link Systems DI-713P Wireless Gateway with firmware 2.60 build 6a
Fingerprint D-Link Systems DI-713P Wireless Gateway
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<CC%SI=<9EC&>2%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-714P+, Firmware V1.33
# D-Link 4-port Broadband VPN Router DI-804HV
Fingerprint D-Link VPN Router DI-714P+/DI-804HV
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<3EC%SI=<6E%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30
Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=N)
T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled
# Date: Oct 14 1997, Time: 09:35:04  (claims software version 2.04B3,
# boot PROM version 2.21)
Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21
Class D-Link | embedded || hub
TSeq(Class=TD%gcd=1388%SI=0)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link Print Server Model DP-101P+
Fingerprint D-Link Print Server
Class D-Link | embedded || print server
TSeq(Class=TD%gcd=<374%SI=<1E)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint D-Link VoIP Gateway GS-104SH
Class D-Link | embedded || telecom-misc
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

# D-Link DI-604 Ethernet router using firmware 1.62 build 2
# DI-707P router
# Sitecom - Broadband Home Station - Firmware R1.96c
# SMC Barricade Broadband Router with firmware R1.96h2 - internal interface
Fingerprint Broadband router or WAP: D-Link DI-series, Sitecom BHS WAP, or SMC Barricade
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-713P - Firmware version 2.60 build 2
Fingerprint D-Link DI-713P WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a)
Class D-Link | embedded || WAP
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-774 - Firmware Version: 2.27
Fingerprint D-Link DI-774 WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DWL-5000AP WAP/BSP 1.3
Class D-Link | embedded || WAP
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# SMC Barricade Wireless Broadband Router (firmware R1.93e)
# D-Link DL-707 Cable/DSL Router
# USR8022 Wireless Cable/DSL Router with firmware V3.1
# Tonze IP-W314E  22 Mbps Wireless All-In-One Broadband Router
Fingerprint D-Link, SMC, Tonze, or US Robotics Wireless Broadband router
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28
# 3Com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2)
Fingerprint Wireless access point (WAP): D-Link DRC-1000AP or 3Com Access Point 2000
Class D-Link | embedded || WAP
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint D-Link DCS-1000 webcam with firmware 1.06
Class D-Link | embedded || webcam
TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint D-Link dcs-5300w Wireless WebCam
Class D-Link | embedded || webcam
TSeq(Class=TD%gcd=<18%SI=<64%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dlink DVC-1100 Wireless Broadband VideoPhone (Application Version 4.0.0.155, Boot Loader Version 2.0.0.2, App Loader Version 1.0.300.102)
Fingerprint D-Link DVC-1000 Wireless Broadband VideoPhone
Class D-Link | embedded || webcam
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AOS/VS on a Data General mainframe
Class Data General | AOS/VS || general purpose
TSeq(Class=TD%gcd=32|64|96%SI=1)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint AOS/VS or VSII
Class Data General | AOS/VS || general purpose
TSeq(Class=TD%gcd=40|80|C0%SI=0)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.11MU02
Class Data General | DG/UX || general purpose
TSeq(Class=TD%gcd=10000|20000|30000%SI=<F)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.20MU02
Class Data General | DG/UX || general purpose
TSeq(Class=TD%gcd=<20004%SI=<1E)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# DG/UX DataGeneral_Server R4.20MU04 generic AViiON Pentium Pro
Fingerprint Data General DG/UX Release R4.20MU04
Class Data General | DG/UX || general purpose
TSeq(Class=RI%gcd=<6%SI=<32CBC&>281)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.20MU06
Class Data General | DG/UX || general purpose
TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint 4.3BSD-tahoe on a MicroVax III
Class DEC | BSD-misc || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OSF/1 V1.3A - 2.0
Class DEC | DIGITAL UNIX | 1.X | general purpose
Class DEC | DIGITAL UNIX | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DIGITAL UNIX OSF1 V 3.0,3.2,3.2C
Class DEC | DIGITAL UNIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC DIGITAL UNIX OSF1 V 4.0-4.0F
Class DEC | DIGITAL UNIX | 4.X | general purpose
TSeq(Class=C|RI%gcd=<6)
T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint DIGITAL UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F
Class DEC | DIGITAL UNIX | 4.X | general purpose
TSeq(Class=RI|TD|64K%gcd=<6)  # Boy, OSF1 comes in all colors!
T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OSF1 (AKA Compaq/DIGITAL Tru64 UNIX) Version 5.0.0
Class DEC | DIGITAL UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint OSF/1 (AKA Compaq/DIGITAL Tru64 UNIX) 5.60
Class DEC | DIGITAL UNIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router
Class DEC | embedded || router
TSeq(Class=TD%gcd=30D4|C35%SI=<F)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# DECserver 700-16, Network Access SW V2.2
Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2
Class DEC | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=600%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.1
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U)
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DIGITAL TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3
Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP
Class DEC | OpenVMS | 6.X | general purpose
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2/Alpha
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=i800|64K)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 ALPHA
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8A840&>1009%IPID=I%TS=U)
T1(DF=N%W=7E4A%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7E4A%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7E00%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 Alpha running DIGITAL's UCX v4.1ECO2 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI|TD%gcd=<6%SI=<BBBB)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1
Fingerprint DEC OpenVMS 7.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U)
T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=)
T4(DF=N%W=C350%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Digital OpenVMS Alpha 7.2
Fingerprint DEC OpenVMS 7.2 Alpha
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# The OS was running on a GS1280 Alpha server
Fingerprint DEC OpenVMS 7.3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenVMS 7.3 with TCP/IP 5.3
Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3)
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3-1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha 7.2-3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS V7.1 on VAX 6000-530
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DEC VAXVMS TCPIP V5.1-15  Full LP Installed
Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS VAX V7.3, Process Software MultiNet V5.0
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U)
T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1
Class DEC | TOPS-20 || general purpose
TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)
Class DEC | TOPS-20 || general purpose
TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint DEC Ultrix 4.1
Class DEC | Ultrix || general purpose
TSeq(Class=64K)
T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC Ultrix 4.2 - 4.5
Class DEC | Ultrix || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3-1 w/Multinet 4.4
Class DEC | VMS || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430
Class DEC | VMS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II
Class DEC | VMS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# VMS 5.5-2 on VAX (VaxStation 4)
Fingerprint DEC VAX/VMS 5.5-2
Class DEC | VMS || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack
Class DEC | VMS || general purpose
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=64%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=64%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DEC VMS MultiNet V4.1(16)
Class DEC | VMS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# dell 5100 printer
# Dell 3100cn printer, OEM of Xerox DocuPrint C525A
Fingerprint Dell 3100cn/5100cn printer
Class Dell | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Dell Remote Access Card III/XT
# Dell Remote Access Card 4/I (DRAC4)
# Drac III/XT Administation Card for Dell PowerEdge
# Dell Remote Access Controller 4/I (DRAC 4/I) Version 1.20 (Build 03.15)
Fingerprint Dell Remote Access Controller III/XT or 4/I
Class Dell | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Dell Powervault 132T Automated Tape Library
Class Dell | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Dell PowerVault 132T Library (Firmware 103D.GY001)
Fingerprint Dell Powervault 132T Automated Tape Library
Class Dell | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Dell Tape Library MSL6030
Class Dell | embedded || storage-misc
TSeq(Class=TD%gcd=<2004%SI=<1D6%IPID=I%TS=1000HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dell PowerConnect 3324 Switch
# Dell PowerConnect 3348 Switch, Software Version 1.2.0.6 Boot Version 1.0.0.13
# Dell 3324 PowerConnect Switch with firmware version 1.1.0.42
Fingerprint Dell PowerConnect Switch 3324 or 3348
Class Dell | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dell PowerConnect 5324 24 Port Gigabit Switch
Fingerprint Dell PowerConnect Switch 5324
Class Dell | embedded || switch
TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dell PowerConnect Switch running SW V.1.0.0.52
Fingerprint Dell PowerConnect Switch running SW V.1.0.0.52
Class Dell | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor
Class Digital Link | embedded || CSUDSU
TSeq(Class=TD%gcd=<2780%SI=<14)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digital Networks VNswitch 900
Class Digital Networks | embedded || switch
TSeq(Class=TD%gcd=<4%SI=<4)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digitel NetRouter NR3000
Class Digitel | embedded || router
TSeq(Class=RI%gcd=<2004%SI=<10CC&>16)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Digitel NetRouter NR3100
Class Digitel | embedded || router
TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Draytek Vigor 2000 ISDN router
Class Draytek | embedded || broadband router
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Draytek Vigor 2200e DSL router v2.1a
Class Draytek | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Draytek Vigor 2200e DSL router v2.1b
Class Draytek | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Software version VIK-1.35.020320j -- www.easytel.fi
Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router
Class Easytel | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Edimax BR-6004 Broadband router
Class Edimax | embedded || broadband router
TSeq(Class=i800%IPID=I%TS=2HZ)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Edimax PS-1001 Print Server model
Class Edimax | embedded || print server
TSeq(Class=TD%gcd=<1C004%SI=<244%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12
Class Edimax | embedded || print server
TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Efficient Networks/SpeedStream DSL router
Class Efficient Networks | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware
Class Eicon | embedded || broadband router
TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM 1100 Office, Firmware 2.50.0005 / 15.11.2001
Fingerprint ELSA LANCOM 1100 office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint ELSA LANCOM DSL I-10 Office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=WNMETL)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM Wireless L-11 3.42.0021 / 24.06.2004
# Lancom (Elsa) DSL I-10 Office Firmware 3.2
Fingerprint ELSA LANCOM DSL I-10 Office router or Wireless L-11
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# LANCOM DSL/10 Office DSL router with firmware v3.22
Fingerprint ELSA LANCOM DSL/10 Office DSL router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM DSL/10 Office router 2.62.0002
Fingerprint ELSA LANCOM DSL/10 office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint ELSA LANCOM DSL/10 office router
Class Elsa | embedded || broadband router
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/
# ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001
Fingerprint ELSA LANCOM DSL/I-1611 Office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1
Class EMC | DART || fileserver
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint EMC IP4700 Filer
Class EMC | DART || fileserver
TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Enterasys XSR-1805 Software Version 6.0.0.0, Built Sep 14 2003, 11:09:28
Fingerprint Enterasys XSR-1805 Security Route
Class Enterasys | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<55280&>B75%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Enterasys XP-2400 switch running Enterasys E9.0.0.0
# Cabletron Smartswitch 6000 running Enterasys E8.2.0.0
Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0
Class Enterasys | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98
Class Epson | embedded || printer
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=)
T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20
Class Epson | embedded || printer
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Ericsson Congo router running software version 9.9.34
Fingerprint Ericsson Congo router
Class Ericsson | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Ericsson HM220dp ADSL modem/router
Class Ericsson | embedded || broadband router
TSeq(Class=TD%gcd=<50000%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code
# Integrated Access Platform, Software Version  = 12.1.1.22 (ISDN Software Version 10.1)
Fingerprint Ericsson Tigris Access Server Software V. 12.1.*
Class Ericsson | embedded || terminal server
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Exabyte X80 tape backup robot
Class Exabyte | embedded || storage-misc
TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Extreme Gigabit switch (unknown version)
Class Extreme Networks | embedded || switch
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Extreme Networks Black Diamond switch
Class Extreme Networks | embedded || switch
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1
Class Extreme Networks | Extremeware || switch
TSeq(Class=RI%gcd=<6%SI=<1598C&>223)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Extremeware Version 6.2.2 (Build 68) by Release_Master 01/15/03 16:58:48
Fingerprint Extremeware 6.2.2
Class Extreme Networks | Extremeware || switch
TSeq(Class=RI%gcd=<6%SI=<2F062&>36C%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86)
Class F5 Labs | BSDI || load balancer
TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# F5 labs BIG-IP Load balancer.  BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386
# F5 BIG-IP 540 loadbalancer.
Fingerprint F5 Labs BIG-IP Load balancer Kernel 4.1.1PTF-03 (x86)
Class F5 Labs | embedded || load balancer
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint F5 Labs BIG-IP load balancer kernel 4.2PTF-05a (x86)
Class F5 Labs | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A
Class FastComm | embedded || specialized
TSeq(Class=TD|RI%gcd=<8%SI=<1E)
T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Fiber Line Wireless Broadband DSL Router, type: 802.11g, hardware release: R1.03SRM firmware version: V1.96.1g
Fingerprint FiberLine Wireless DSL router
Class FiberLine | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<23C9F22&>5B99B%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP)
Class FiberLine | embedded || WAP
TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# FlowPoint 144 or 22XX DSL Router v3.0.8
# SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready
Fingerprint DSL Router: FlowPoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1
Class FlowPoint | embedded || broadband router
Class SpeedStream | embedded || broadband router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E)

Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router
Class FlowPoint | embedded || broadband router
Class ASCOM | embedded || broadband router
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Fore ForeThought 7.1.0 ATM switch
Class Fore | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Fore ATM BX200 (S_ForeThought_ATM_8.3.0.N) GA-Update (1.133285)
Fingerprint Fore ForeThought 8.3.0.N ATM BX200 switch
Class Fore | embedded || switch
TSeq(Class=RI%gcd=<3EC%SI=<2F9B8&>5BD%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Fortigate-50A running FortiOS V2.80,build393,050405
Fingerprint Fortinet firewall Fortigate 50A (FortiOS V2.80)
Class Fortinet | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=Y%W=16D0%ACK=O%Flags=AS%Ops=M)
PU(Resp=N)

# Fortinet Fortigate-60 firewall version 2.80,build430,050609
Fingerprint Fortinet firewall Fortigate 60
Class Fortinet | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry FastIron Edge Switch (load balancer) 2402
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Foundry 1500 OS Ver 7.2.06T51
# Foundry ServerIron XL 16 Port 7.3.06T12
Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Foundry Networks Biglron 8000 load balancer
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<4C464&>294%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43
Class Foundry | IronWare || load balancer
TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13
Class Foundry | IronWare || load balancer
TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43
Class Foundry | IronWare || load balancer
TSeq(Class=C)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12
Class Foundry | IronWare || load balancer
TSeq(Class=C)
T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint FreeBSD 2.1.0 - 2.1.5
Class FreeBSD | FreeBSD | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.2.1 - 4.1
Class FreeBSD | FreeBSD | 2.X | general purpose
Class FreeBSD | FreeBSD | 3.X | general purpose
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<38E50&>906)
T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M)
T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.2.1-STABLE
Class FreeBSD | FreeBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<74A54&>1295)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 3.2-4.0
Class FreeBSD | FreeBSD | 3.X | general purpose
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<92D42&>1769)
T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint FreeBSD 3.4-RELEASE
Class FreeBSD | FreeBSD | 3.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# DragonFly 1.1-Stable #0: Sun Nov 14 17:22:45 CET 2004
# DragonFly 1.1-CURRENT (i386) build on 2004/12/03
Fingerprint DragonFly 1.1-Stable (FreeBSD-4 fork)
Class FreeBSD | FreeBSD | 4.x | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.0-20000208-CURRENT
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<63074&>FC4)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.1.1 - 4.3 (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.10-STABLE  i386
Fingerprint FreeBSD 4.10-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.3-RC
# FreeBSD 4.2-RELEASE i386
Fingerprint FreeBSD 4.2 - 4.3-RC (X86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<B23B8&>CD3%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.3 - 4.4-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.3 - 4.4PRERELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.4 for i386 (IA-32)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13)
Class FreeBSD | FreeBSD | 4.X | general purpose
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ)
T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002
Fingerprint FreeBSD 4.4-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.5-RELEASE (or -STABLE) (x86)
# FreeBSD 4.6-RC
Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.6-RELEASE FreeBSD 4.6-RELEASE #0 i386
Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# 4.6-RELEASE
# 4.6-STABLE
# 4.6.2-RELEASE-p6
Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%IPID=I%TS=100HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6-RC on Alpha
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6.2-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-RELEASE
# 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002
Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE
# FreeBSD 4.8-RELEASE-p13
Fingerprint FreeBSD 4.7 - 4.8-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386
Fingerprint FreeBSD 4.7-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.7-RELEASE through 4.8-RELEASE (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE-p3 on i386
Fingerprint FreeBSD 4.7-RELEASE-p3
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-STABLE (Jan 2003)
Fingerprint FreeBSD 4.7-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.9-PRERELEASE alpha
# FreeBSD 4.8-RELEASE on DEC Alpha
# FreeBSD 4.9-STABLE (platform unspecified)
Fingerprint FreeBSD 4.8-RELEASE through 4.9-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-STABLE (June 2003)
Fingerprint FreeBSD 4.8-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ)
T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-STABLE (June 2003)
Fingerprint FreeBSD 4.8-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.8-STABLE - 4.9-PRERELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.0-RELEASE x86
# sparc64 running FreeBSD 5.1-RELEASE
# FreeBSD 4.9-STABLE FreeBSD 4.9-STABLE  i386
Fingerprint FreeBSD 4.9 - 5.1
Class FreeBSD | FreeBSD | 4.X | general purpose
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.9-RELEASE-p1 #0 i386
Fingerprint FreeBSD 4.9-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# 4.9-RELEASE FreeBSD 4.9-RELEASE #0
Fingerprint FreeBSD 4.9-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.9-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

#  FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002
Fingerprint FreeBSD 5.0-CURRENT (Apr 2002)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386
# FreeBSD 5.0-RELEASE Alpha
Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.1-RELEASE (x86)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.2
Class FreeBSD | FreeBSD | 5.X | general purpose
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|84%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.2-CURRENT (Jan 2004) on x86
# FreeBSD 5.2.1-RELEASE i386
# FreeBSD 5.3-RELEASE #0
Fingerprint FreeBSD 5.2 - 5.3
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-RELEASE
# FreeBSD 5.2-CURRENT i386
# FreeBSD 5.4-RELEASE #4
# FreeBSD 5.4-Stable
# FreeBSD 5.4-STABLE #0
# BummiOS 5.4-CURRENT i386 (based on FreeBSD 5.4-STABLE)
Fingerprint FreeBSD 5.2 - 5.4
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|U)
T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.2-CURRENT (Jun 25, 2004) on x86 running pf as firewall with "scrub in all"
# FreeBSD 5.3-Beta2 (x86)
# FreeBSD 5.3-RELEASE (x86) Generic kernel
Fingerprint FreeBSD 5.2-CURRENT - 5.3 (x86) with pf scrub all
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.2.1 running on Ultra5 spac64
Fingerprint FreeBSD 5.2.1 (SPARC)
Class FreeBSD | FreeBSD | 5.X | general purpose
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-STABLE (x86) as of 2004.11.14
# FreeBSD 5.3-RELEASE
Fingerprint FreeBSD 5.3
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3rc3 with pf scrub all
Fingerprint FreeBSD 5.3
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# FreeBSD 5.3-RELEASE i386
Fingerprint FreeBSD 5.3-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.3-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-STABLE #7 Tue Feb 8 17:55:23 WET 2005 i386
Fingerprint FreeBSD 5.3-STABLE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-STABLE as of 2004-11-14, pf scrib in all random-id
Fingerprint FreeBSD 5.3-STABLE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# FreeBSD 5.4-RC2 FreeBSD 5.4-RC2 #2 i386
# FreeBSD 5.4-STABLE FreeBSD 5.4-STABLE #7 i386
Fingerprint FreeBSD 5.4
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=O|S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.4-RELEASE-p2 i386
Fingerprint FreeBSD 5.4-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 6.0-CURRENT #1 i386
# FreeBSD 5.2.1-RELEASE
Fingerprint FreeBSD 5.2.1-RELEASE or 6.0-CURRENT
Class FreeBSD | FreeBSD | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeSCO 0.27 (Linux 2.0.38)
Class FreeSCO | Linux | 2.0.X | router
TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint FreeSCO 0.27 (Linux 2.0.38)
Class FreeSCO | Linux | 2.0.X | router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP
Class Galacticomm | WorldGroup || BBS
TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack
Class Galacticomm | WorldGroup || BBS
TSeq(Class=C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Gandalf LanLine Router
Class Gandalf | embedded || router
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1
Class Gauntlet | Solaris | 2.5.X | firewall
TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U)
T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Genius Print Server
Class Genius | embedded || print server
T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface)
Class Global Technology Associates | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<F708&>264)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# GNet BB0040 DSL router
# SAR-703 Combined ADSL Modem/Router
Fingerprint GNet BB0040 or SAR 703 DSL modem + router
Class GNet | embedded || broadband router
Class SAR | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) x86
Class GNU | Hurd || general purpose
TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# GrandStream 486 Voice over IP adapter
Fingerprint GrandStream 486 VoIP adapter
Class GrandStream | embedded || VoIP adapter
TSeq(Class=C%Val=3883537A%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Grandstream HT-286 POTS<->VoIP phone gateway device
Class Grandstream | embedded || VoIP adapter
TSeq(Class=C%Val=66559055%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream BT-100 IP Phone
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint GrandStream BT-100 IP Phone
Class GrandStream | embedded || VoIP phone
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=800|C00|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50
Fingerprint Grandstream BT-101 IP phone
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=C00|800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1000|C00|800%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# GrandStream BT-101 with firmware 1.0.5.22
Fingerprint GrandStream BT-101 IP phone
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream BudgeTone 101 IP Phone
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream IP Phone
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# GrandStream BudgeTone-100 VoIP phone
# GrandStream BudgeTone-100 1.0.5.16
Fingerprint GrandStream VoIP Phone (BudgeTone-100)
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=400|800|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=400|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16
Fingerprint Grandstream VoIP Phone (BudgeTone-101)
Class GrandStream | embedded || VoIP phone
TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint PalmOS 5.2.1 on Handspring Treo
Class Handspring | PalmOS | 5.X | PDA
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Hawking PS12U Embedded Print Server  (Firmware Version :    6.09.17H (2003/04/18 16:55:07)
Fingerprint Hawking PS12U Embedded Print Server
Class Hawking | embedded || print server
TSeq(Class=TD%gcd=78000|F0000%SI=<14%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Zero One Tech. Print Server 3000
# Hawking Print Server PN7117
# Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049)
# EUSSO Technologies UPS1211-B print server
Fingerprint Print server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B
Class Hawking | embedded || print server
Class Zero One | embedded || print server
Class EUSSO | embedded || print server
TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Hitachi HI-UX/MPP
Class Hitachi | HI-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Don't ask me what this is :)  David says
# it is "a Utah port of BSD to HP machines"
Fingerprint HP-BSD 2.0
Class HP | BSD-misc || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP Procurve Routing Switch 9304M
Class HP | embedded || load balancer
TSeq(Class=C)
T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP J4899A ProCurve Switch 2650, H.08.53, ROM H.08.02 - 24 port HP Switch with 2 Uplinks
# HP ProCurve Switch 2626 - Firmware revision  : H.08.67
# HP Procurve Switch 5304XL - Image stamp: /sw/code/build/alpmo(dex_v09_2)
Fingerprint HP Procurve Switch 2600 series or 5304XL
Class HP | embedded || load balancer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP LaserJet 1300N with JetDirect 200m LIO card
Fingerprint HP printer w/JetDirect card
Class HP | embedded || print server
TSeq(Class=RI%gcd=<6%SI=<8C9B0&>1295%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP Buisiness InkJet 1200 internal print server
# HP Deskjet 6127, firmware FD4R019A
Fingerprint HP Deskjet 6127 printer or InkJet 1200 printer server
Class HP | embedded || printer
Class HP | embedded || print server
TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
T1(DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550
# HP LaserJet 2200 with JetDirect (J6057A)
# HP Wireless JetDirect EIO card - 680n
Fingerprint HP JetDirect Card in a LaserJet printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)

# HP Laserjet 4250, HP JetDirect J7949E
# hp LaserJet 2420
# hp LaserJet 4250 w/ embedded HP JetDirect J7949E; firmware V.28.43.FF w/ datecode 20040902 08.007.0
# HP LaserJet 2420dn printer, JetDirect J7949E, firmware V.28.43
# hp LaserJet 4250 with embedded HP JetDirect J7949E
# HP LaserJet 2420 printer
Fingerprint HP LaserJet 2420 or 4250 printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP LaserJet 4000N Printer
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP LaserJet 4100N printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP LaserJet 5
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# 2100 Series, 4000 TN, 4000 PS, 8000 DN
# Hewlett-Packard Digital Sender 9100C (http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15179-64175-64404-12126-64404-428008.html)
Fingerprint HP LaserJet printer/print server
Class HP | embedded || printer
Class HP | embedded || print server
Class HP | embedded || scanner
TSeq(Class=TD%gcd=<6%SI=<100)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Jet Direct Model J3113A, Firmware Rev G.07.20
# HP Color LaserJet 4500N, Jet Direct J3113A/2100
Fingerprint HP printer w/Jet Direct
Class HP | embedded || printer
T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP JetDirect printer/print server
# HP JetDirect J3111A, firmware G.05.35
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP printer w/JetDirect card (Firmware Rev. H.06.00)
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<8%SI=<14)
T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer
# JetDirect 610n (Model J4169A) firmware L.24.06
# HP Color LaserJet 4600 Model Number: J6057A Firmware Rev: R.25.09
# HP Laserjet 4200 Network Printer
# HP JetDirect J6057A, firmware R.24.08 (internal print server in a LaserJet 4050n)
# HP Color Laserjet 4650 printer
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ)
T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# This is a HP 5si printer with a JetDirect Ethernet card model# J2556b Firmware A.05.32
Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32)
Class HP | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect J2556b card firmware A.05.32
Class HP | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP iLO (Integrated Lights Out) Firmware Version 1.20 (12/04/2002)
# HP Integrated Lights Out (iLO) with firmware 1.41 08/19/2003
Fingerprint HP Integrated Lights Out remote configuration Board
Class HP | embedded || remote management
TSeq(Class=TD%gcd=<194%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Router 210 with OS 9.72
# Netgear RP114 DSL-Router with 4-Port Switch
Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch
Class HP | embedded || switch
Class Netgear | embedded || broadband router
TSeq(Class=TD%SI=<20)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400%ACK=O%Flags=R%Ops=)
T6(DF=N%W=400%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Entria II with Kernel B.09.11 and Boot Block B.08.02
Fingerprint HP Entria II X station
Class HP | embedded || X terminal
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 A 9000/715 or 9000/899
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# XXX: It crashed the machine again, but I got a full
# scan this time.
Fingerprint HP-UX B.10.01 A 9000/715
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K|TR)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 9000/897
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 A 9000/750
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0
Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX release B.10.20 version A
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP9000 Model 804 K450 running HP-UX 11.00
# Mac OS9
Fingerprint Apple Mac OS 9, or HP-UX 11.00
Class HP | HP-UX | 11.X | general purpose
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4F254&>C95)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX B.11.00
# HP-UX B.11.11
Fingerprint HP-UX 11
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<A7B0C&>C6E%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 11 w/tcp_isn_passphrase
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# This is a weird one
Fingerprint HP-UX 11.00
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TD%gcd=>20000%SI=<3)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX test01 B.11.11 U 9000/800 1277844053 unlimited-user license
Fingerprint HP-UX 11.11
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<C7A6A&>ABA%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 11.11
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL)
T4(DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T7(DF=N%W=1000|800|C00%ACK=S%Flags=R%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.11.00 A 9000/785
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.11.00 A 9000/800
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint HP-UX B11.00 U 9000/839
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<2114C&>536)
T1(Resp=N)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX 7.0 B 9000/375
Fingerprint HP-UX 7.0
Class HP | HP-UX | 7.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 9.01 - 9.07
Class HP | HP-UX | 9.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777
Class HP | HP-UX | 9.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP MPE/iX 5.5
Class HP | MPE/iX || general purpose
TSeq(Class=TD%gcd=<6%SI=<14)
T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP MPE/iX 5.5 on HP 3000
Class HP | MPE/iX || general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
T1(DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP Entria X station (running Netstation 7.x)
Class HP | Netstation || X terminal
TSeq(Class=64K)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

#  HPJ2600A Ethernet hub or HP ProCurve Switch 4000M
# Bay Networks MicroAnnex XL running firmware 10.0B
Fingerprint VxWorks 5.3.x bases system (usually an Ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server
Class HP | VxWorks || switch
Class Bay Networks | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1)
Class Huawei | VRP || router
TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ)
T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Huawei Quidway Router R2621E VRP 1.5.6
Class Huawei | VRP || router
TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ)
T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Hydra HydraWEB 5000
Class Hydra | embedded || load balancer
TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2 running on RS/6000
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2.3 running on RS6000 model 560
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2.5 (Bull HardWare)
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX v3.2.5 running on 8xPower-2 wide nodes
# Fingerprint IBM AIX Version 4
Fingerprint IBM AIX v3.2.5 - 4
Class IBM | AIX | 3.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.0 - 4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.02.0001.0000
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.1
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.1-4.1.5
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2-4.3.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2.X-4.3.3.0
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%IPID=I%TS=U)
T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=5B4|F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=1000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 4.3.3 on an RS/6000 H50
# Fingerprint IBM AIX 4.3.3 on a p660-6M1
# IBM AIX 4.3.3 ML10
Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/*
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM-RS/6000 7017-S80, AIX Version 4.3.3.0
Fingerprint IBM AIX 4.3.3.0 on an IBM RS/*
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX v4.1 running on a C10
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX v4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E)

Fingerprint IBM AIX Version 4.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 5.1.0.0 maintenance level 3
Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5L 5.1
# IBM AIX 5.1 ML00
# AIX 5.1.4
# IBM AIX 5L Version 5.2
Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.1 on pSeries LPAR
# AIX 2 5 000B8CDC4C00 IBM AIX 5.2L Update 2
Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# aix 5.1 Maintenance Level 6
Fingerprint IBM AIX 5.1 on a p610-6C1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1-5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.103 on
Fingerprint IBM AIX 5.103
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.2 on pSeries (Power4)
Fingerprint IBM AIX 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.2 (Maintenance Level 1) on RS/6000
Fingerprint IBM AIX 5.2 (on RS/6000)
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# AIX 5.2-003
Fingerprint IBM AIX 5.2.3
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 5L V5.3 5765-G03 (2005/02) on IBM p5 (Power5 processor)
# Fingerprint IBM AIX 5.3 ML 01 on RS/6000 43P150
Fingerprint IBM AIX 5.3
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.3 ML01
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM 8222 hub
Class IBM | embedded || hub
TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 8239 Token-Ring Stackable Hub
Class IBM | embedded || hub
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Microplex M205 Pocket Print Server v5.7
# IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ]
Fingerprint IBM 6400 printer or Microplex Pocket Print Server
Class IBM | embedded || printer
Class Microplex | embedded || print server
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint IBM Infoprint 12 Net-Printer
Class IBM | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint IBM BladeCenter Remote Management Module
Class IBM | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM Remote Supervisor Adapter II
Class IBM | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint IBM 2210 router
Class IBM | embedded || router
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface
Class IBM | embedded || router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3  340),
Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks
Class IBM | embedded || router
TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router
Class IBM | embedded || router
Class Proteon | OpenRoute || router
TSeq(Class=TD%gcd=<6%SI=<BB)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 3494 Magnetic Tape Library
Class IBM | embedded || storage-misc
TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT
Class IBM | embedded || switch
Class Xylan | embedded || switch
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# AGE Logic, Inc. IBM X-Station
Fingerprint AGE Logic, Inc. IBM XStation
Class IBM | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS
Class IBM | MVS || general purpose
TSeq(Class=RI%gcd=64|C8|12C|190)
T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2
Class IBM | MVS || general purpose
TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200)
T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)

Fingerprint IBM MVS TCP/IP TCPMVS 3.2
Class IBM | MVS || general purpose
TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS TCP/IP TCPOE 3.3
Class IBM | MVS || general purpose
TSeq(Class=RI%gcd=<6%SI=<BB0)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/2 V 2.1
Class IBM | OS/2 || general purpose
TSeq(Class=64K)
T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 V.3
Class IBM | OS/2 || general purpose
TSeq(Class=i800)
T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp 4.0
Class IBM | OS/2 || general purpose
TSeq(Class=i800)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OS/2 Warp Server for eBusiness 4.52
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<8%SI=<5A9A6&>633%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/390 V2R10
Class IBM | OS/390 | V2 | general purpose
TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint IBM OS/390 V5R0M0
Class IBM | OS/390 | V5 | general purpose
TSeq(Class=RI%gcd=<5%SI=>F&<BBBB)
T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# added by Beat Rubischon <beat@rubis.ch>
Fingerprint IBM AS/400 V3 and V4
Class IBM | OS/400 | V3 | general purpose
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V3
Class IBM | OS/400 | V3 | general purpose
TSeq(Class=RI%gcd=<8%SI=<3411C4&>5977%TS=1000HZ)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AS/400 running OS/400 R4.4
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4 r4-5
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R2M0
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R5
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=C%IPID=I%TS=1000HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R5M0
Class IBM | OS/400 | V4 | general purpose
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AS/400 running OS/400 5.1
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM proprietary operating system for AS/400 systems (now known as "iSeries")
# Fingerprint OS/400 V5R2
# IBM OS/400 V5R1M0
Fingerprint IBM OS/400 V5R1 - V5R2
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I)
T1(DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java
Fingerprint IBM OS/400 V5R1M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ)
T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM OS/400 V5.2
Fingerprint IBM OS/400 V5R2M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I)
T1(DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V5R2M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<8%SI=<2871A2&>276C%IPID=I%TS=1000HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# IBM iSeries OS/400 V5R2M0 L000
# IBM AS/400 - Operating System: OS/400 V5R2M0 (Version 5, Revision 2)
# IBM OS/400 V5R3M0 on iSeries
# OS/400 V5R3
Fingerprint OS/400 V5R2M0 or V5R3 or V5R3M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<14%SI=<2EB440&>EF0%IPID=I%TS=1000HZ)
T1(DF=Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM VM/CMS (mainframe)
Class IBM | VM/CMS || general purpose
TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System
Class IBM | VM/CMS || general purpose
TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF)
T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Infortrend EonStor A16U-G1410, firmware 3.42D.03
Fingerprint Infortrend EonStor A16U-G1410
Class Infortrend | embedded || storage-misc
TSeq(Class=RI|TD%gcd=<6%SI=<17CA%IPID=RD|RPI%TS=U)
T1(DF=N%W=5C8%ACK=S++%Flags=AS%Ops=MNNL)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192
# innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096
Fingerprint innovaphone IP200/IP400 VoIP phone/gateway
Class innovaphone | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Intel NetStructure 3110 VPN Gateway V6.90p7
Fingerprint Intel NetStructure 3110 VPN Gateway
Class Intel | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Intel InBusiness Print Station
Class Intel | embedded || print server
TSeq(Class=64K)
T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel NetportExpress 10 3-port Print Server
Class Intel | embedded || print server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a
Fingerprint Intel NetportExpress 10/100 3-port Print Server
Class Intel | embedded || print server
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel NetportExpress PRO Print Server V04.33a
Class Intel | embedded || print server
TSeq(Class=TD%gcd=1%SI=0)
T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Intel NetportExpress XL Print Server
Class Intel | embedded || print server
TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Fingerprint Intel ER8100ST Express 8100 Router running firmware 3.20n
Fingerprint Intel ER8100ST Express Router 8100
Class Intel | embedded || router
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Intel Corporation, ER9100 Express Router 9100
# Fingerprint by Ron van Daal (ronvdaal@syntonic.net)
Fingerprint Intel ER9100 Express Router 9100
Class Intel | embedded || router
TSeq(Class=TD%gcd=10|20|30%SI=1)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel Express 510T switch
Class Intel | embedded || switch
TSeq(Class=TD%gcd=10|20|30%SI=<BB)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel Express 510T switch
Class Intel | embedded || switch
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel NetStructure 470T Switch
Class Intel | embedded || switch
TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480
Class Intergraph | CLiX || general purpose
TSeq(Class=TD%gcd=<416%SI=<1E)
T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1
Class Intergraph | CLiX || general purpose
TSeq(Class=TD%gcd=209|1048|E3F%SI=<5)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph jetSpeed 520 ADSL Router
Class Intracom | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=18%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/
Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall
Class IPCop | Linux | 2.2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.27 (x86) ipcop 1.40
# Linux ipcop 2.4.27 #1 Thu Sep 30 02:57:11 GMT 2004 i586 AuthenticAMD unknown GNU/Linux
# IPcop v1.4.2 Linux 2.4.27
# Linux fw.ioes.org 2.4.27 #1 Wed Sep 29 12:48:42 GMT 2004 i686 GenuineIntel unknown GNU/Linux (IPCOP+1.4)
# Linux 2.4.27-29 (IPCop 1.4.2)
# IPCop 1.4.2 (Kernel: 2.4.27) i486
# Linux 2.4.27 i686 GNU/Linux IPCop 1.4.2 (Green Interface)
# Linux 2.4.29 #1 i686 GenuineIntel+unknown GNU/Linux / IPCop 1.4.5
# IPCop Linux  1.4.5  (Linux xxx 2.4.29 #1) Pentuim II
# IPCOP 1.4.6 based on Debian/Linux 2.4.29
Fingerprint IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall
Class IPCop | Linux | 2.4.X | firewall
TSeq(Class=RI%gcd=<6%SI=<24E74F4&>49DD3%IPID=Z%TS=U)
T1(DF=Y%W=16D0|400C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IPRoute V1.18, compiled at 08:26:02 on Jun 23 1998
Fingerprint IPRoute (DOS based software router)
Class IPRoute | DOS || software router
TSeq(Class=TD%gcd=<6%SI=<82%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=E0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IQinVison IQeye3 Version V2.1/1(030123)
Fingerprint IQinVison IQeye3 webcam
Class IQinVision | embedded || webcam
TSeq(Class=RI%gcd=<6%SI=<5168&>B3%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# IronPort AsyncOS 3.7.1-001 running on C60 platform
Fingerprint IronPort C60 email security appliance
Class IronPort | AsyncOS || specialized
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Isolation Systems Infocrypt Enterprise
Class Isolation | embedded || encryption accelerator
TSeq(Class=C)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server
Class Ixia | embedded || specialized
TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Juniper Networks JUNOS 5.3 on an Olive router
Class Juniper | JUNOS || router
TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box.
Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on x86 box
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Juniper Networks JUNOS 5.5R1.2 built 2002-09-28
Fingerprint Juniper Networks router JUNOS 5.5R1.2
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Juniper router M10i JUNOS ROUTER 7.2R1.7 #0 i386
Fingerprint Juniper Networks router M10i running JUNOS 7.2R1.7
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Juniper Router running JUNOS
Class Juniper | JUNOS || router
TSeq(Class=RI%gcd=<5%SI=>FFF)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# KA9Q is a networking OS used mostly by amateur radio operators for radio to
# internet gateways.
Fingerprint KA9Q amateur radio OS
Class KA9Q | KA9Q || specialized
TSeq(Class=TD%gcd=37000%SI=<1E)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# 3Com OfficeConnect 812 ADSL router firmware 2.0.0
# Kentrox DataSMART 656 CSU/DSU or USR NETServer/16
Fingerprint Kentrox DataSMART 656 CSU/DSU, USR NETserver/16, or 3Com OfficeConnect ADSL router
Class Kentrox | embedded || CSUDSU
Class US Robotics | embedded || switch
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint KIRK Wireless Server 600
Class KIRK | embedded || VoIP gateway
TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Konica-Minolta magicolor2300DL printer controller f/w 02.83S engine f/w 4131.50G1.0900
Fingerprint Konica-Minolta magicolor2300DL printer controller
Class Konica | embedded || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Kronos Time clock
Class Kronos | embedded || specialized
TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Kyocera FS-1700+ printer
Class Kyocera | embedded || printer
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Kyocera IB-21 Printer NIC
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=100%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Kyocera FS-9100 DN printer, network firmware IB-21E 1.3.1
# Kyocera FS-6020 laser printer, system firmware 90.06, engine firmware A005, network firmware IB-21E 1.3.1
# Kyocera FS-5016N IB-21E Version 1.3.0
# Kyocera-Mita 2050 printer/copier/scanner
# Kyocera Printer FS-1900 (network firmware IB-21E 1.3.0)
# Kyocera IB-21E network module version 1.3.1
# KYOCERA Printer I/F IB-21E Ver 1.3.0
# Kyocera-Mita IB-21E
Fingerprint Kyocera Printer (network module IB-21E 1.3.x)
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=5B4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5B4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=5B4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Kyocera SB-4e Printer-Interface in an Kyocera FS-800 laser printer
Fingerprint Kyocera SB-4e printer NIC
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Labtam MT300, X-Terminal Kernel
Class Labtam | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix LSB4 Ethernet Switch
Class Lantronix | embedded || switch
TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Radionics Ram IV Alarm System
# Lantronix CoBox DR1-IAP serial device server
Fingerprint Lantronix CoBox serial device server or Radionics RAM IV Alarm
Class Lantronix | embedded || terminal server
Class Radionics | embedded || specialized
TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U)
T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Lantronix Consoleserver 800 (Technically, it is a Lightwave Consoleserver 800 prior to Lantronix purchase of the company.)
Fingerprint Lantronix Consoleserver 800
Class Lantronix | embedded || terminal server
TSeq(Class=TD%gcd=<6%SI=<14%IPID=I%TS=100HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<404C&>90)
T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix EPS1 Print Server version V3.5/1(970325)
Class Lantronix | Punix || print server
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Lantronix EPS1 Printer Server running Punix version  2.9/342(930813)
Fingerprint Lantronix EPS1 Printer Server
Class Lantronix | Punix || print server
TSeq(Class=RI%gcd=<6%SI=<10018&>8F%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix EPS2 Print Server Version V3.5/2(970721)
Class Lantronix | Punix || print server
TSeq(Class=RI|TD%gcd=<6)
T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Lantronix ETS16 Version V3.1/2(940207) / [Punix version 2.9/379(940207)]
Fingerprint Lantronix ETS16 terminal server
Class Lantronix | Punix || terminal server
TSeq(Class=RI%gcd=<6%SI=<41E9C&>AD%IPID=RPI|BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Leunig ePower Switch b723 v5.2
Class Leunig | embedded || power-device
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Fingerprint LevelOne WBR-3406TX Wireless Broadband router
Class Level One | embedded || broadband router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=1540|1638%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# LevelOne Wireless router WBR-3403TX
Fingerprint LevelOne WBR-3403TX Wireless Broadband router
Class Level One | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<102C870&>295B1%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Lexmark M412n network printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ)
T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark Marknet X2031e printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ)
T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Lexmark Optra N Laser Printer
Fingerprint Lexmark Optra N Laser Printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=1C%RIPTL=0%RID=0%RIPCK=0%UCK=F%ULEN=134%DAT=E)

# Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1
# Lexmark Optra Lx+ Network Printer, firmware
Fingerprint Lexmark Optra network printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=388|1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Lexmark Optra T612 (printer) running firmware 3.11.17
# Lexmark Optra S 2420
Fingerprint Lexmark Optra printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter
Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

#  Lexmark Optra S 1659 (MarkNetS)
#  Lexmark Optra S 2455 and SC 1275
# Lexmark S 1855 Firmware 1.9.14 Bootcode revision 7.3
Fingerprint Lexmark Optra S Printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=>1000%SI=<30)
T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Lexmark T520 printer, firmware 54.30.39
Fingerprint Lexmark T520 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<3651E88&>8AEFD%IPID=Z%TS=100HZ)
T1(DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark T522 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ)
T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark T522/T622 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ)
T1(DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint LG Goldstream LR3001f router, software version 4.0
Class LG GoldStream | embedded || router
TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5
Class LG GoldStream | embedded || router
TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Liebert Intellislot SNMP/Web Card (power devices, air conditioning, etc.)
Class Liebert | embedded || specialized
TSeq(Class=TD%gcd=<32DC4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# "This device listens on all TCP and all UDP ports, so OS
#  fingerprints are not that excellent. Actually there's not even an OS
#  running on it, it simply translates monitoring data into SNMP OIDs. It
#  can also be used to control the unit by setting specific OIDs."
Fingerprint Liebert-Hiross HiSNMP A/C controlling unit
Class Liebert-Hiross | embedded || specialized
T1(DF=Y%W=2000%ACK=S++%Flags=BAS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=UAPSF%Ops=M)
T4(Resp=N)
T5(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
T6(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
PU(Resp=N)

# Linksys WET-11 Wireless Ethernet bridge running firmware rev. 1.43
Fingerprint Linksys WET-11 Wireless Ethernet bridge
Class Linksys | embedded || bridge
TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys WGA54G Wireless Game Adapter (bridge)
Class Linksys | embedded || bridge
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Linksys EtherFast Cable/DSL Router with 4-port switch BEFSR41 ver. 3; firmware: 1.44.3, FEB 13 2003
Fingerprint Linksys BEFSR41 Broadband router
Class Linksys | embedded || broadband router
TSeq(Class=TD%gcd=<18%SI=<1E%IPID=Z%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFSR41 Broadband router and 4-port hub
Fingerprint Linksys BEFSR41 Broadband router
Class Linksys | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2FF88AC&>7ACA0%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys/Cisco BEFSR41 V3 Etherfast Cable/DSL Router (Firmware 1.04.17)
Fingerprint Linksys BEFSR41 V3 Etherfast cable/DSL router
Class Linksys | embedded || broadband router
T1(Resp=N)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFVP41 VPN Router - Firmware Version 1.41.1, Sep 04 2003
Fingerprint Linksys BEFVP41 VPN Router
Class Linksys | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFW11S4 DSL/Cable Router with Firmware 1.45z
Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router
Class Linksys | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=4009%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys BEFW11S4 firmware revision 1.45.10
Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router
Class Linksys | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# LinkSys WRT-54G running the SVEASOFT code
# Linksys BEFW11S4 802.11B WAP
# Linksys BEFSR41 firmware ver. 1.40.2
# Linksys Router: BEFW11S4 v2/v3
Fingerprint Linksys BEFW11S4/WRT-54G Wireless Broadband router or BEFSR41 Cable/DSL router
Class Linksys | embedded || broadband router
TSeq(Class=TD|RI%gcd=<400%SI=<62C%IPID=Z|RD%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys WAG54G Wireless Broadband Router
Fingerprint Linksys WAG54G Wireless Broadband Router
Class Linksys | embedded || broadband router
TSeq(Class=TD%gcd=<E0%SI=<1E%IPID=Z%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800|1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys WAG54G Wireless Gateway
Class Linksys | embedded || broadband router
TSeq(Class=RI%gcd=<8%SI=<1CE6872&>24FCE%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linux kernel 2.4.20 (mips) on Linksys WRT54G Wireless Broadband Router with firmware Sveasoft +Alchemy-pre7a beta build version v3.37.6.8sv
Fingerprint Linksys WRT54G Wireless Broadband Router (Linux kernel 2.4.20)
Class Linksys | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<17B7D1A&>3BAFF%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys EtherFast Print Server
Class Linksys | embedded || print server
T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys EtherFast Print Server
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys PSUS4 USB Print Server and switch
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys WPS54GU2 Wireless Print Server
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=APS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C|0%ACK=S++|O%Flags=APS|AR%Ops=M|)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys WRK54G Firmware Version: 1.56.01
# Linksys Wireless-B router/switch/802.11b access point (device model BEFW11S4 V4)
# Linksys BEFW11S4 firmware 1.50.14
# Linksys BEFSR41 v2 Firmware Version:  1.46.02, Aug 03 2004
# Linksys BEFSR81v2 Router with firmware 2.45.10
# Linksys EtherFast Cable/DSL Router (Model: BEFSR41 Ver 2)(Updated Firmware ver. 1.46.02, Aug 03+2004)
# Linksys Wireless-B Broadband Router BEFW11S4 Firmware v.1.50.14
# Linksys RT31P2  VoIP router (Vonage; firmware version 1.28.00; internal interface)
Fingerprint Linksys BEFW11S4/BEFSR41/BEFSR81/WRK54G Broadband router or RT31P2 VoIP router
Class Linksys | embedded || WAP
TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys WAP11 v2.6 firmware 1.06
Fingerprint Linksys WAP11 Wireless AP
Class Linksys | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Planet embedded WAP-1965
# Linksys WAP11 Wireless AP v2.2 firmware 1.06
# D-Link DWL-900+ with Firmware Version 2.57, Wed, 30 Apr 2003
# D-Link DWL - 2000 AP (WAP) firmware 2.04
Fingerprint Linksys, D-Link, or Planet WAP
Class Linksys | embedded || WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# fingerprint!
Fingerprint Linux 1.0.9
Class Linux | Linux | 1.X | general purpose
TSeq(Class=TD%gcd=30|60%SI=<F)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.2.13
Class Linux | Linux | 1.X | general purpose
TSeq(Class=TD%gcd=1%SI=1C)
T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.2.8 - 1.2.13
Class Linux | Linux | 1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<BBBB)
T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.3.20 (x86)
Class Linux | Linux | 1.X | general purpose
T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.0
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.27 - 2.0.30
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.32-34
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# On very rare cases, I get a T2 response back -- weird
Fingerprint Linux 2.0.32-34
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.34-38
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386)
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.39
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.19 - 2.2.25
Class Linux | Linux | 2.1.X | general purpose
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ)
T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.1.24 PowerPC
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.76
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=TR)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.88
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7)
T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.91 - 2.1.103
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>7A000)
T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.12 - 2.2.25
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|60|A0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.13
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# SuSE Linux 6.3 (i386) - Kernel 2.2.13
Fingerprint Linux 2.2.13 (SuSE; x86)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.14
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7)
T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)

Fingerprint Linux 2.2.16C37_III on Sun Cobalt
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2021DA2&>3CBCC%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.2.19-6.2.1ensim-3.1.5-2 (RedHat 7.2)
Fingerprint Linux 2.2.19
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<242483C&>5C202%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.19 (Alpha)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1409420&>3348D%IPID=I%TS=1000HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.19 - 2.2.20
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.2.19 on a DEC Alpha 233mhz Multia
Fingerprint Linux 2.2.19 on a DEC Alpha
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.20 SMP
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.2.21 SMP (x86)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.22
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.5 - 2.2.13 SMP
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C)
T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)

# Linux kernel 2.4.4-4GB (X86) from Red hat
Fingerprint Linux 2.4.4
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<FC5E4&>19E%IPID=Z%TS=U)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linux 2.3.12
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<20%SI=>DDDD)
T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.28-33
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3)
T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA)
T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.49 x86
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E)
T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Astaro Security Linux 4 (Kernel 2.4.19)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# I don't put "Gentoo" as the vendor for the classification because it
# makes output ugly when there are a bunch of Linux matches due to
# firewalling or similar problems.
Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586
Fingerprint Linux 2.2.16
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.0 - 2.5.20
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U)
T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0|8|14|20|28|38|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.0 - 2.5.20 w/o tcp_timestamps
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U)
T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.0-test5
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8)
T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)

# Linux 2.4.18
# SuSE Linux 7.3 linux-2.4.10-4GB, running on amd k6-2
Fingerprint Linux 2.4.10 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D0|D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Strangely enough, I have received several prints like this that claim a T2:
Fingerprint Linux 2.4.16 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.17 on HP 9000 s700
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z)
T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Debian/Gnu Linux 3.0 (Woody) Kernel 2.4.18-bf2.4
Fingerprint Linux 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<293EE44&>69651%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 (PPC)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<36CB986&>488A7%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2774D66&>2F583%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.18-custom
# Linux 2.4.19 w/o tcp_timestamps
Fingerprint Linux 2.4.18 - 2.4.19 w/o tcp_timestamps
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1720870&>361B9%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 - 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=30|60|D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20 (Gentoo 1.2; x86)
# Linux 2.4.18-14
Fingerprint Linux 2.4.18 - 2.4.20 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# linux 2.4.20 (i586) Preemptible
# Linux 2.4.18
# 2.4.21-20.ELsmp SMP RedHat AS3, REL3
Fingerprint Linux 2.4.18 - 2.4.21 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.21-4.0.1.ELsmp x86 Dual Xeon RedHat EL3 AS3 (Red Hat Linux 3.2.3-20)
# Linux Kernel 2.4.21-4.0.1 Red Hat Enterprise Linux ES release 3 (Taroon)
# Linux sun 2.4.27 #3 SMP Mon Nov 1 21:24:45 GMT 2004 sparc unknown unknown GNU/Linux
# Linux AthenA-server 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i586 unknown
Fingerprint Linux 2.4.18 - 2.4.27
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<2CA3968&>49B3D%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux live cd knoppix 2.4.27 (knoppix 2.6)
Fingerprint Linux 2.4.18 - 2.4.27
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3859E24&>47DBA%IPID=Z%TS=100HZ)
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux 4.19-4GB #1 Tue Sep 30 19:01:07 UTC 2003 i686 unknown / SuSe Linux OpenExchange Server
Fingerprint Linux 2.4.19
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<13A36B6&>3244E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.19C13_V (X86) Sun Cobalt RaQ550
Fingerprint Linux 2.4.19
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux
Fingerprint Linux 2.4.19 (Mandrake, X86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.19 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-4GB-athlon i686
# SuSE Linux 8.2 2.4.20-64GB-SMP
# linux 2.4.19-4GB
Fingerprint Linux 2.4.19 - 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ)
T1(DF=Y%W=16A0|1680|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.19 w/grsecurity patch
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.20-4GB (X86)
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-wolk4.16s
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=7D74%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20; Sysctl goodness below. Changed default TTL, syncookies, not sure what else. Scanned from localhost.
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2C88A&>1E5%IPID=RD)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.20 from ALT Linux Master 2.2 (uname -r = 2.4.20-alt16-smp)
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<25A8F50&>60659%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-8 #1 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1A82ACC&>43DBE%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Red Hat Linux release 9 (Shrike) Kernel 2.4.20-8 on an i686
Fingerprint Linux 2.4.20 (Red Hat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1B9DCC2&>469F7%IPID=Z%TS=100HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.4.20 (X86, Redhat 7.3)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ)
T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Red Hat Linux release 9 (Shrike), Kernel Version 2.4.20-31.9.progeny.5
# Linux 2.4.21-27.0.2.EL i686 i386 (Red Hat Enterprise Linux ES release 3 (Taroon Update 4)) + APF 0.9.3
# Linux 2.4.21-15.0.4.ELsmp #1 SMP i686 i686 i386 GNU/Linux
# Linux 2.4.22-1.2115.nptlsmp
# Linux 2.4.22-1.2199.nptlsmp #1 SMP i686 i686 +i386 GNU/Linux
Fingerprint Linux 2.4.20 - 2.4.22
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3089154&>7C37E%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

# Linux 2.4.20-gentoo-r5 w/grsecurity
Fingerprint Linux 2.4.20 - 2.4.22 w/grsecurity.org patch
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux kernel 2.4.20-wolk4.17s (X86)
# Linux demeter 2.4.20-wolk4.17s #1 i686 unknown
# "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux
# Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R
Fingerprint Linux 2.4.20 - 2.4.28
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=1690|16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.20 or 2.6.0-test5-love3 (x86)
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<DDDFF6&>23458%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.20 x86
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1DB22CE&>1862A%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-ac2
Fingerprint Linux 2.4.20-ac2
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A812D4&>2F29E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.21-32.0.1.ELsmp #1 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.4.21
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<31EB9A2&>7FCA1%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# RedHat Linux Enterprise 3 2.4.21-27.0.2.EL #1
Fingerprint Linux 2.4.21 (RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux Boobie 2.4.21-9.EL #1 RedHat
Fingerprint Linux 2.4.21 (RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E5DABA&>58D55%IPID=Z%TS=100HZ)
T1(DF=Y%W=564%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# base on msg 1058, 1776
# Linux kernel 2.4.21-243(athlon) from SuSE 9.0
# SuSE 9.0 with updates, kernel 2.4.21-280-default
Fingerprint Linux 2.4.21 (Suse)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<243DCC4&>17466%IPID=I%TS=U)
T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SuSE Linux 8.1 (i386) 2.4.21 #4 SMP
Fingerprint Linux 2.4.21 (Suse, X86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# SuSE Linux 9.0 2.4.21-215-athlon
# Linux 2.4.21-121-athlon; SuSE, x86
# Linux 2.4.21-231-athlon from SuSE 9.0
Fingerprint Linux 2.4.21 (x86 SuSE)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C5FBC4&>48A1C%IPID=I%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux 2.4.21-0.25mdk x86
Fingerprint Linux 2.4.21 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A2786A&>6BE77%IPID=I%TS=100HZ)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux mail2 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux (Redhat Enterprise Linux AS 3)
Fingerprint Linux 2.4.21 (x86, RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<26BFF42&>63303%IPID=Z%TS=100HZ)
T1(DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.21-166-default (Suse 9)
# Linux 2.4.23-pre6aa3 #2 Wed Mar 10 23:27:52 BRT 2004 i686 GNU/Linux
Fingerprint Linux 2.4.21 - 2.4.23
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<139B84E&>3230A%IPID=I%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Debian Linux feeshus 2.4.22-1-ipvs-686 #1
Fingerprint Linux 2.4.22
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<180F182&>3D924%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22 (SPARC)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<256B646&>5FC9A%IPID=Z%TS=100HZ)
T1(DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22 (x86) without timestamps, grsecurity 1.9 (rand_isns, rand_ip_ids)
Fingerprint Linux 2.4.22 (x86) w/grsecurity patch and with timestamps disabled
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR|RI%gcd=<6%IPID=RD|Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22 (x86, Gentoo)
# Linux server 2.6.7-ck5 (x86)
# Linux lamaquina 2.6.8.1-10mdk #1 Wed Sep 8 17:00:52 CEST 2004 i686 AMD Athlon(tm) 64 Processor 3200+
Fingerprint Linux 2.4.22 - 2.6.8
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<132F658&>188E0%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Kernel 2.6.10-ck (x86) Gentoo system
Fingerprint Linux 2.4.22 or 2.6.10
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<29CB48E&>6AF95%IPID=Z%TS=U)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22 (x86, Gentoo)
# Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux
# Slackware 10 kernel 2.6.7
# Fedora Core 2 With Kernel 2.6.8-1
# Kernel 2.6.3 (X86); Gentoo Distro
# Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux
# Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3
Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11A9004&>2D341%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22-gentoo-r7 (x86)
# Linux 2.6.4-gentoo-grsec (x86) - manual patch on gentoo's kernel (gentoo-dev-sources) with grsecurity-2.0-test2-2.6.4.patch
# Linux 2.6.10 with grsecurity 2.6.10 i686
Fingerprint Linux 2.4.22 or 2.6.4 - 2.6.10
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22-ck2 (x86)   w/grsecurity.org and HZ=1000 patches
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22-gentoo-r2 i686
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux gateway 2.4.22-gentoo-r5 #1 ven feb 6 05:25:25 CET 2004 i686 Celeron (Mendocino) GenuineIntel GNU/Linux - grsecurity patch + iptables
Fingerprint Linux 2.4.22-gentoo-r5 (x86) w/grsecurity
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22-gentoo-rc
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<22F8152&>2CC16%IPID=RD%TS=1000HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.23 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B5505C&>6EEAA%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.23-grsec w/o timestamps
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Adamantix GNU/Linux with Linux 2.4.25-grsec (X86)
Fingerprint Linux 2.4.25 w/grsec (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26-gentoo-r6 #1 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<298F858&>6A637%IPID=I%TS=U)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26  from slackware linux 10
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2961188&>6375E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.26 from Slackware 10.0
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3230066&>338AC%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26 i686 GNU/Linux
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2049F82&>52A3D%IPID=Z%TS=100HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26-gentoo-r12 #5 i686 Pentium II
# Linux 2.4.26-gentoo-r9 #14 i686 Celeron (Mendocino) GenuineIntel GNU/Linux
Fingerprint Linux 2.4.26 (gentoo)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2E22EC4&>27AD8%IPID=I|RD%TS=100HZ)
T1(DF=N|Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.26-gentoo-r6 w/grsec
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.27-1-586tsc #1 Wed Dec 1 19:25:25 JST 2004 i586 GNU/Linux (Debian Sid)
Fingerprint Linux 2.4.27 or D-Link DSL-500T (running linux 2.4)
Class Linux | Linux | 2.4.X | general purpose
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2031130&>5267C%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.27-grsec #1 SMP i686
# Linux 2.4.27-grsec (x86) (grsecurity 2.0.1) w/ net.ipv4.tcp_timestamps = 0
Fingerprint Linux 2.4.27 with grsec
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.27 with grsec
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.29 from Slackware 10.1.0
Fingerprint Linux 2.4.29
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2209F48&>571E7%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.30 (vanilla)
Fingerprint Linux 2.4.30
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<293A11E&>6963B%IPID=Z%TS=100HZ)
T1(DF=Y%W=1578%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1578%ACK=S++|O%Flags=AS|A%Ops=MNNTNW|NNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.4-4GB #1 Wed May 16 00:37:55 GMT 2001 i586 unknown
Fingerprint Linux 2.4.4
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<10F070C&>15ACF%IPID=Z%TS=100HZ)
T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26 #6 i686 unknown unknown GNU/Linux
# Linux kernel 2.6.9-1.681_FC3 from Fedora Core 3
Fingerprint Linux 2.4.6 - 2.4.26 or 2.6.9
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680|16A0|4000|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.7 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U)
T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.7 (zLinux on OS/390)
Fingerprint Linux 2.4.7 (zLinux on OS/390)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ)
T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.18 on Alpha EV4
# Linux 2.5.70 (x86)
# Linux 2.6.4 i686
# Linux gentoo 2.6.7-gentoo-r11 i686
# Linux gentoo 2.6.11-gentoo-r9
Fingerprint Linux 2.4.7 - 2.6.11
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Athena 2.6.3-1-686 #2 Tue Feb 24 20:24:38 EST 2004 i686 GNU/Linux
# Linux 2.4.7 (RedHat 7.3 on SPARC)  
Fingerprint Linux 2.4.7 - 2.6.11
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1682210&>399B1%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux RedHat 2.4.18-5 #1 Mon Jun 10 15:31:48 EDT 2002 i686 unknown
Fingerprint Linux 2.4.9 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C3AE82&>46383%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Mandrake Communiry 10.1  (2.6.8.1-10mdk-i586-up-1GB)
# Linux matrix 2.6.3-gentoo-r2 x86
Fingerprint Linux 2.5.25 - 2.6.8 or Gentoo 1.2 Linux 2.4.19 rc1-rc7
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Xbox running Debian Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linux 2.5.5 (Gentoo)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<306B8C0&>6ABCE%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<269E81A&>62D97%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<34CD71A&>861AC%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.10 #1 Wed Jan 5 12:36:35 CET 2005 i686 unknown  Debian 3.0r2
# linux gentoo kernel 2.6.10
# Linux kernel 2.6.10-custom (x86) from Debian GNU/Linux 3.1
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1A5ABDA&>43761%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=38|A0|B8|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.3-gentoo-r1 #5 Wed Apr 7 13:48:31 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
# Gentoo 1.4.16; Kernel 2.6.7
# Linux sarge 2.6.8-2-386 #1 Thu May 19 17:40:50 JST 2005 i686 GNU/Linux
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<16883CC&>1CD61%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.8.1-12mdk #1 i686 Intel(R) Xeon(TM) CPU 2.80GHz unknown GNU/Linux
# Linux 2.6.8-1-k7 #1 i686 GNU/Linux
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18C0F36&>3F49D%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.8-1-k7-smp (X86) Debian GNU/Linux 3.1 (Sarge - testing)
# Linux 2.6.11-gentoo-r2-ck1
# Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16
# Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.9 #1 i686
# Linux kernel 2.6.9 (PIII-80Mhz)
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2AB93AA&>6D5A3%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=28|40%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0-test10 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<226FBCC&>58267%IPID=Z%TS=1000HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.0-test5 x86
Fingerprint Linux 2.6.0-test5 x86
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2D3CFA0&>73C6B%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0-test7 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1488090&>34896%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0-test9 - 2.6.0 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<263F536&>61B8F%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Gentoo Linux running on a UML client, Linux 2.6.10-linode12 #1 i686 UML User Mode
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2CE05FC&>72AE6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.10 i686 on IBM Thinkpad T30
# Linux barton 2.6.10-gentoo-r6 Gentoo
# Linux 2.6.10-grsec #1 Fri Jan 28 00:37:15 CET 2005 i686 GNU/Linux
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<321C62E&>8044F%IPID=I|RD%TS=1000HZ)
T1(DF=Y|N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.10 X86 Slackware 10.0
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Ubuntu Hoary Hedgehog - Linux ubuntu 2.6.10-5-386 #1 Tue Apr 5 12:12:40 UTC 2005 i686 GNU/Linux
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<15962A2&>3740B%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux runerm 2.6.10-kanotix-8 #1 Wed Feb 2 16:49:31 GMT 2005 i686 GNU/Linux
# Linux Kernel 2.6.11 With some Fixes from debian/kanotix
# debian 3.1 kernel : 2.6.11-rc7
Fingerprint Linux 2.6.10 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<249F172&>5DBEE%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux linux 2.6.11.9 #1 Sat May 14 00:49:06 CEST 2005 i686 unknown unknown GNU/Linux
Fingerprint Linux 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.11 (gentoo-dev-sources)
Fingerprint Linux 2.6.11 (gentoo)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linux 2.6.10-1.741_FC3 i686 athlon i386 GNU/Linux
Fingerprint Linux 2.6.3 - 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3552DC&>8860%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Kernel 2.6.3 (X86)
# Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486
Fingerprint Linux 2.6.3 - 2.6.7 (X86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.3-6mdksecure #1 SMP x86_64 from Mandrake 10
# Linux 2.6.8-p4 #1 SMP i686 GNU/Linux
Fingerprint Linux 2.6.3 or 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<24F1576&>1E7BD%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# LINUX Suse 9.1 Professional Kernel 2.6.4 i686
Fingerprint Linux 2.6.4 (Suse)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1B18996&>45556%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Slackware current kernel 2.6.9
# Fedora Core 3 Linux Kernel 2.6.9 x86 (i386)
# Linux kernel 2.6.4-52 from (X86) SuSE Linux 9.1
# Debian Sarge Linux 2.6.6-1, i686 (x86)
Fingerprint Linux 2.6.4 - 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<28A04EC&>2F60A%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|800|C00|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|1000|400|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.6.5
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<265B754&>6225F%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linux 2.6.7-gentoo-r11 #2 Wed Jul 28 23:25:03 PDT 2004 i686 Pentium II (Deschutes)
# Linux  2.6.8-rc3 #1 Sat Aug 7 07:19:34 EDT 2004 i686 GNU/Linux
# Debian Sarge GNU/Linux kernel 2.6.8-1 (i386)
# Linux 2.6.7-hardened-r17 Gentoo
# Linux 2.6.9-1.681_FC3smp #1 SMP i586 i586 i386 GNU/Linux (Fedora Core 3+kernel as supplied)
# Linux 2.6.8-1-686 from Debian sid
# SuSE Linux Prefessional 9.1, with kernel 2.6.10
# Linux 2.6.8, PLD distribution, SMP
# Linux 2.6.11.4-20a-default #1 i686 i686 i386 GNU/Linux from+Suse 9.3
# Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux
# Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 )
# Linux Debian Sarge 2.6.11.7
# Linux kernel 2.6.10-4GB (X86) with Debian GNU/Linux 3.1
# Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody
Fingerprint Linux 2.6.5 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2BF6254&>70895%IPID=Z%TS=1000HZ)
T1(DF=Y%W=15E0|16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux 2.6.9 #1 i686 Intel(R) Pentium(R) 4 CPU 3.06GHz+GenuineIntel GNU/Linux
# Linux kernel 2.6.10-rc3 from Gentoo on an Ultra 1 (sparc)
# Linux 2.6.5 i686 P42.00GHz, Gentoo Base System version 1.6.6, Portage+2.0.51-r3
# Gentoo Linux 2004.1 PPC (old blue and white G3)  Kernel 2.6.11.7
Fingerprint Linux 2.6.5 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<360764E&>48D40%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.6-rc2-bk3
Fingerprint Linux 2.6.6
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E04BFE&>4ADED%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.6-1-k7 (X86) from Debian Testing
Fingerprint Linux 2.6.6-1-k7 (X86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ)
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.7-tp #5 i686 GNU/Linux
Fingerprint Linux 2.6.7
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<13C059A&>1B365%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.7 with grsecurity patches
Fingerprint Linux 2.6.7
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.7-hardened-r16 (Gentoo hardened-dev-sources) x86
# Linux 2.6.7-hardened-r16 #3 SMP i686  GNU/Linux (grsec+pax, gentoo hardened-dev-sources))
Fingerprint Linux 2.6.7
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.7 (X86) from Mepis
Fingerprint Linux 2.6.7 (X86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.8 on PLD Linux
# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community
# Linux kernel 2.6.8.1-10mdk (X86) from Mandrake 10.1 community
# Linux kernel 2.6.7-SMP from Knoppix 3.6
# Linux 2.6.8.1-4-k7 i686 GNU/Linux
Fingerprint Linux 2.6.7 - 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1D19DA8&>4A672%IPID=Z%TS=1000HZ)
T1(DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.7 w/grsecurity.org patch
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.8-24.14-smp GNU/Linux Suse Linux 9.2 Professional
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<C0DF46&>1ED0B%IPID=Z%TS=1000HZ)
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Mandrake 10.1, i586, kernel 2.6.8.1-12mdk
# Linux 2.6.8.1-12mdk #1 Fri Oct 1 12:53:41 CEST 2004 i686 AMD Athlon(tm) XP 3000+ unknown GNU/Linux
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1E91DE8&>4E3D1%IPID=Z%TS=1000HZ)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.8-1.521 #1 i686 athlon i386 GNU/Linux
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<C88D22&>20154%IPID=I%TS=1000HZ)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.8-2-k7 #1 Thu May 19 18:03:29 JST 2005 i686 GNU/Linux
# Linux 2.6.8-2-386 #1 Mon Jan 24 03:01:58 EST 2005 i686 GNU/Linux, from Debian testing
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<32035F2&>2A223%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Debian Sarge Kernel 2.6.8
Fingerprint Linux 2.6.8 (Debian)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2C96D4E&>34B7A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux ubuntu 2.6.8.1-5-386 #1 Sat Feb 12 00:19:31 UTC 2005 i686 GNU/Linux
Fingerprint Linux 2.6.8 (Ubuntu)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<10F66C0&>2B6A6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Linux kernel 2.6.8.1 from Debian sarge netinst
# Linux kernel 2.6.11-1.27 from Fedora Core 3
Fingerprint Linux 2.6.8 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<23C986A&>4BB91%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.9-gentoo-r13Hipcia #3 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
# Linux 2.6.8-1-686-smp #1 SMP i686 GNU/Linux from Debian 3.1
Fingerprint Linux 2.6.8 - 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11DFD8E&>15CCF%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.9-1.649 FC Rawhide
# Linux kernel 2.6.9 (x86_64) from kernel.org
Fingerprint Linux 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<13935EA&>32119%IPID=Z%TS=1000HZ)
T1(DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.9-1.681_FC3 #1 i686 i686 i386 GNU/Linux Fedora Core 3
Fingerprint Linux 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BA9D60&>26DF4%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.5 (Gentoo)
# Linux 2.6.8 (Fedora Core 2)
# Fingerprint Linux kernel 2.6.8-1.521 Fedora 2
Fingerprint Linux kernel 2.6.5 - 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<17F9116&>3D580%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control
Class Livingston | ComOS || terminal server
Class 3Com | ComOS || terminal server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint ATT UNIX SVR4.2 on a Lucent Definity voicemail system
Class Lucent | BSD-misc || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2
Class Lucent | ComOS || terminal server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.sics.se/~adam/lwip/
Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32
Class lwIP | lwIP || general purpose
TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U)
T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# M0n0wall 1.2b2 - Firewall based on FreeBSD 4.1
# M0n0wall 1.2b2 FreeBSD-based firewall running on PC Engines WRAP board (Geode x86 architecture)
# m0n0wall FreeBSD based firewall (http://m0n0.ch/wall/) version 1.2b3 (version 1.2 beta 3) generic PC
# m0n0wall Router/Captive portal version 1.2b8 running on stripped down version of FreeBSD
Fingerprint M0n0wall 1.2b2 - 1.2b8 FreeBSD 4.1 based firewall
Class m0n0wall | FreeBSD | 4.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# m0n0wall or pfsense firewall distro based on FreeBSD 5.3
# M0n0wall (FreeBSD 5.3 based) with firmware beta version 1.2b7
Fingerprint M0n0wall 1.2b7 FreeBSD 5.3 based firewall
Class m0n0wall | FreeBSD | 5.X | firewall
TSeq(Class=TR%gcd=<6%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Madge Smart Ringswitch
Class Madge | embedded || switch
T1(DF=N%W=1F4%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Magna SG10 intranet router
Class Magna | embedded || router
TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Maxim-IC TiniOS DS80c400
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Maxim/Dallas TINI embedded Java v1.02b
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TD%gcd=<1F408%SI=<28%IPID=Z%TS=U)
T1(DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
T4(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# Maxim/Dallas TINI embedded Java v1.11
# Dallas Semiconductor TINI OS 1.02d
Fingerprint Maxim/Dallas TINI embedded Java v1.02d
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MegaBit Gear TE4111C modem
Class Megabit | embedded || terminal server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
Class Meridian | embedded || storage-misc
TSeq(Class=TD%gcd=40000%SI=<A)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microbase VirtuOS v3.00b R.09
Class Microbase | VirtuOS || general purpose
TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microplex Print Server
Class Microplex | embedded || print server
TSeq(Class=C)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Bart's Network Boot Disk 2.7 http://www.nu2.nu/bootdisk/network/ i386
Fingerprint Bart's Network Boot Disk 2.7 (X86) MS-DOS
Class Microsoft | DOS || general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint NCSA Telnet (dos)
Class Microsoft | DOS || general purpose
TSeq(Class=C)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# I'm not 100% sure this version is for DOS, just a guess
Fingerprint NCSA Telnet 2.3.08 for the PC (DOS)
Class Microsoft | DOS || general purpose
TSeq(Class=C)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Watt-32 DOS tcp/ip stack
Class Microsoft | DOS || general purpose
TSeq(Class=C%IPID=I%TS=1000HZ)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint WNOS 5.0 on Microsoft DOS 6.22
Class Microsoft | DOS || general purpose
TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft xbox with hacked bios and xbmc running
# Evolution-X 2.X (unsure which evolution-x version is running, one from the 2.X series though...) on mod-chipped XBOX
# XBOX running Xbox Media center v1.0.0
# Microsoft XBOX 1.0.5101.1, mod chip ALX2+, running Avalaunch v0.49.3 Xmas edition
# XBox hardware version 1.5 running XBox Media Centre version 1.1.0
Fingerprint Microsoft Xbox (modified)
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<5C26%IPID=RPI|I%TS=U)
T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# xbox v1.1 running EvoX bios
# v1.5 XBOX running Evolution build 3935, fresh default install.
# Microsoft XBOX with SmartXX modchip - running XBOX Media Center v1.0
# Microsoft Xbox v1.6
Fingerprint Microsoft Xbox (modified)
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<AD02&>20%TS=U)
T1(DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Microsoft Xbox Console running Xbox Media Centre version 1.1.01
# Microsoft Xbox (modified) running EvolutionX
Fingerprint Microsoft Xbox (modified)
Class Microsoft | embedded || game console
TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U)
T1(DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Xbox V1.1 Running Evolution-X Dashboard v1.8.3752
Fingerprint Microsoft Xbox (modified) running evolutionX
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U)
T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Xbox (modified) running UnleashX 0.26
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<A79E&>99%IPID=I%TS=U)
T1(DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340
Fingerprint Microsoft Windows Longhorn Preview
Class Microsoft | Windows Longhorn || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, Enterprise Edition, Build 3790
# Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947)
# Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947)
# Windows Server 2003 Standard Edition. no SP, all current hotfixes
Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server Edition, no service packs
Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
T4(DF=N%W=C00|400%ACK=S%Flags=R%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL)
T7(DF=N%W=C00|1000|400%ACK=S%Flags=R%Ops=WNMETL)
PU(Resp=N)

Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server (Version 5.2 build 3790.srv03_rtm.030324-2048)
Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 Enterprise Edition (English) with latest Windows Update patches as of September 2, 2004
Fingerprint Microsoft Windows 2003 Server Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
T1(DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, Enterprise Edition, no service packs, (build 3790.srv03_rtm.030324-2048)
# Microsoft Windows XP Professional (English) SP2 with latest updates through Nov. 24, 2004
Fingerprint Microsoft Windows 2003 Server Enterprise Edition or XP Pro SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows.NET Enterprise Server (build 3615 beta)
# Windows .NET Standard Server build 3604
# Microsoft Windows 2003 Standard Build V5.2.3790 build 3790
# Microsoft Windows 2003 Server - Web edition - all available critical fixes as of 15th feb 2004
# Windows 2003 Standard Edition RTM
# Window Server 2003 Enterprise Edition Swedish
# Microsoft Windows XP Professional (English) w/ SP2 RC1 build 2600.xpsp_sp2_rc1.040311-2315 - WINDOWS FIREWALL DISABLED
# Microsoft Windows 5.2 Build 3790.srv03_rtm.030324-2048
# Microsoft Windows Version 5.1 (Build 2600.spdp_sp2_rtm.040803-2158 : Services Pack 2)
Fingerprint Microsoft Windows 2003 Server or XP SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows XP Pro (French) version:2002 SP2
# Microsoft Windows Server 2003 version 5.2 (Build 3790.srv03_gdr.040410-1234)
# Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from Microsoft as at 06/03
# Microsoft Windows 2003 Server Enterprise Edition (German) build 3790.srv03_rtm.030324-2048
# Microsoft Windows .NET Standard Server RC#2 (build 3718)
# Microsoft Windows XP Professional version 2002 service pack 2
# Microsoft Windows XP Home Edition (English) SP2 Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows XP Home /SP2 Polish Edition
Fingerprint Microsoft Windows 2003 Server or XP SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y|N%W=2017|402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0|20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Windows Server 2003, build 3790
# Microsoft Windows XP Media Center Edition
Fingerprint Microsoft Windows 2003 Server or XP SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server with SP1 and latest Windows Update patches as of May, 2005
# Windows Server 2003 w/ SP1, build 3790.srv03_sp1
# Microsoft Windows 2003 Server, version SBS 2003 Premium, just after Windows Server SP1 installed
# Windows Server 2003 Version 5.2 (Build 3790.srv03_sp1_rtm.050324-1447: Service Pack 1
# Windows Server 2003 w/ SP1, build 3790.srv03_sp1
Fingerprint Microsoft Windows 2003 Server SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 SP1 [Version 5.2.3790]
# Windows 2003 Service Pack 1 32 Bit Running on Abit Mobo AMD64
Fingerprint Microsoft Windows 2003 Server SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 5.2 (Build 3790.srv03_sp1_rtm.050324-1447 : Service Pack 1)
# Windows Server 2003 SP1 all patches as of June-23-05
Fingerprint Microsoft Windows 2003 Server SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server Standard Edition (Build 3790.srv03_gdr.040410-1234)
Fingerprint Microsoft Windows 2003 Server Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Windows 2003 Server Standart Edition SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=5C%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2003 standard edition version 5.2 build 3790.srv03_rtm.030324-2048 and lastest windows updates patches as november 9, 2004
Fingerprint Microsoft Windows 2003 standard edition
Class Microsoft | Windows | 2003/.NET | general purpose
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, No Service Packs build 3790.srv03_gdr.040410-1234
Fingerprint Microsoft Windows Server 2003
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 Enterprise Edition Version 5.2.3790
Fingerprint Microsoft Windows Server 2003 Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=10%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B
Class Microsoft | Windows | 3.X | general purpose
TSeq(Class=TD%gcd=10000%SI=<FF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98
Class Microsoft | Windows | 3.X | general purpose
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<F%SI=<F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 95 Version 4.00.950 OEM HP Pavilion 5010
Fingerprint Microsoft Windows 95 4.00.950
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=BI)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Win95 4.00.950B  -  IE 5 5.50.4807.2300
Fingerprint Microsoft Windows 95 4.00.950B
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4)
T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<FFF)
T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows 98 X86 No Service Pack
# Microsoft Windows 98 4.10.1998
Fingerprint Microsoft Windows 98 4.10.1998
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<142%SI=<186%IPID=BI%TS=U)
T1(DF=Y%W=2024|7D78%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2024|7D78%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 4.10.1998
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U)
T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE 4.10.2222A
# Windows 98 4.10.1998
Fingerprint Microsoft Windows 98 or 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 SP1
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<5%SI=<20)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 SP2
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=270F|5FA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=270F|5FA0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE, no service packs, on AMD Sempron 2.4 GHz
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<1AA4&>D%IPID=RPI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 98 4.10.2222.A
# "Windows 98SE, patched up to date" (1/25/03)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98 4.10.2222 A (1/27/04)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<F4%SI=<14%IPID=RPI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE (build 2222)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 98SE, no service packs
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<FF%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE + unoffical service pack 1.6.1 (includes all cumulative patches and hotfixes)
#                (http://exuberant.ms11.net/98sesp.html)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<E2%SI=<1E%IPID=RPI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98SE + IE5.5sp1
Class Microsoft | Windows | 95/98/ME | general purpose
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Win 98SE, 4.10.2222 A (fully WindowsUpdated)
# Windows 98SE build 4.10.2222 A
# Microsoft Windows 98SE, Version 4.10.2222
# Windows 98SE 4.10.2222 A  Compaq OEM version Patched as of 1/2005
Fingerprint Microsoft Windows 98SE 4.10.2222
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=BI|RPI%TS=U)
T1(DF=Y%W=2017|2058|FAF0|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017|2058|FAF0|FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 98SE, service pack 1 installed, litepc installed (www.litepc.com)
Fingerprint Microsoft Windows 98SE SP1
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98SE with security patch A
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Millenium Edition - no service packs
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B05C&>2D1%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows ME + all updates as of 1/1/03
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Millennium (German) 4.90.3000
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I)
T1(DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Millenium Edition v4.90.300
# Windows Me or Windows 2000 RC1 through final release
# Microsoft Windows 2000 Advanced Server
# Windows 2000 with SP2 and long fat pipe (RFC 1323)
# Windows 2000 Professional Service Pack 3
# Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes
# Windows 2000 Professional (x86)
# Compaq ProLiant DL-380G2 running Windows 2000 with SP3 and all the current patch sets (2/3/03)
# Windows XP Professional version 2002 on PC Intel processor
# Windows XP Build 2600
# XP Professional 5.1 (build 2600).. all patches up to June 20, 2002
# Fingerprint Microsoft Windows XP Professional with all current updates to May 2002
# Windows 2000 Version 5.0 Build (2195: Service Pack 3)
#  Windows 2000 Advanced Server SP3
Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0)
T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT)
T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Windows NT 3.51 SP5
Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0)
T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows XP Professional (English) w/ SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Widows XP Professional (English UK) SP2 - latest patches as of 20 Dec 2004 - build 2600.xpsp_sp2_rtm.040803-2158
# Microsoft Windows XP Home Edition (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158
# Microsoft Windows XP Profesional (English) SP2 Ver 5.1 build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2
Fingerprint Microsoft Widows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Advanced Server SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<22FBA&>28B%IPID=I)
T1(DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Advanced Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I)
T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02
Fingerprint Microsoft Windows 2000 Advanced Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I)
T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows 2000 Advanced Server Service Pack 4 With ALL updates as of October 9th 2003 Winver: Version 5 build 2195 SP4
Fingerprint Microsoft Windows 2000 Advanced Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1FD06&>42A)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Advanced Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<7CE98&>6B7)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows 2000 Advanced Server Version 5.0 (Build 2195: Service Pack 4)
Fingerprint Microsoft Windows 2000 Advanced Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Professional
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C476&>472)
T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|20|80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2000 Professional (Russian) SP2 with some antiworm patches (MS04-011 etc.), firewalled with wipfw (http://wipfw.sourceforge.net) dropping TCP_SYNFIN
# Microsoft Windows 2000 Professional Rus with SP2 with only Sasser etc. patches
Fingerprint Microsoft Windows 2000 Professional (Russian) SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<3073C&>393)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE)
T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows NT 5 Beta2 or Beta3
# Microsoft Windows 2000 Professional Edition (English) Build 2195 with SP2 - x86
Fingerprint Microsoft Windows 2000 Professional SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<6%SI=<1000)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 Professional Build 2195 Service Pack 3
Fingerprint Microsoft Windows 2000 Professional SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U)
T1(DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# base one msg 170, 666
# Windows 2000 Professional SP4 fully patched as of 10/20/04
# Microsoft Windows 2000 Professional SP4 and latest Windows Update as of December 8th, 2004
# Microsoft Windows 2000 Professional Version: 5.0.2195 Service Pack 4 Build 2195
# Microsoft 2000 Professional SP4  CPU AMD
Fingerprint Microsoft Windows 2000 Professional SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<2B0D4&>22E%IPID=I)
T1(DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Professional SP4 build 2195
Fingerprint Microsoft Windows 2000 Professional SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<29B6C&>2EF%IPID=I%TS=U)
T1(DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1B26A&>26A%IPID=I%TS=U)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I)
T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Server with Service Pack 3 and MS Exchange 2000 Server
Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<DF0C&>186%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:Service Pack 1)
Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U)
T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Server (Spanish) with SP4 build 2195
Fingerprint Microsoft Windows 2000 Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<67DF4&>2FB%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=A%Ops=NNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Server with SP4 and Windows Update patches as of January 14, 2005.
# Microsoft Windows 2000 Server with SP4 and latest Update Patches as of January 10 2005
Fingerprint Microsoft Windows 2000 Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<E76A8&>110C)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|68%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Windows 2000 Server Edition Version 5.0 (Build 2195: Service Pack 4)
Fingerprint Microsoft Windows 2000 Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<21E62&>256%IPID=I)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<DDB08&>6AA%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 Server SP4 with all current patches april 9th 2005
Fingerprint Microsoft Windows 2000 Server SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C3B8&>157%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2003 Standard build 3790
# Microsoft Windows 2003/.NET Standard Edition
# Windows 2000 Server with SP4 fully patched as of 10/8/04
Fingerprint Microsoft Windows 2000 Server SP4 or 2003 Server Standard Edition
Class Microsoft | Windows | NT/2K/XP | general purpose
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNNT)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2000 Server with SP4 and no other updates
# Windows 2000 Server SP 4 + ALL patches at 25 Sep. 2003
# Windows XP Professional SP1 and latest Windows Update patches as of Oct 04, 2004
Fingerprint Microsoft Windows 2000 Server SP4 or XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B430&>5AD%IPID=I)
T1(DF=Y%W=FA00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1F216&>251%IPID=I)
T1(DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Build 2195 Service Pack 1
Fingerprint Microsoft Windows 2000 SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U)
T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 version 5 build 2195 Service Pack 2
Fingerprint Microsoft Windows 2000 SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1D362&>237%IPID=I)
T1(DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2FE90&>6F9%IPID=I%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2928E&>4B7%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Professional SP2
# Microsoft Windows XP Professional SP1
# Microsoft Windows XP Professional, ver. 5.1 Build 2600.xpclnt_qfe.010827-1803
Fingerprint Microsoft Windows 2000 SP2 or XP or XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<327F6C&>3E9%IPID=I)
T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# base on msg 1039
# Microsoft Windows 2000 SP2 with Hotfix Q300972, Q301625
Fingerprint Microsoft Windows 2000 SP2 with Hotfix (Pre-SP3)
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<1E08C&>15A%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Professional with SP3 and latest Windows Update
# patches as of August 22, 2003 - Laptop using G-Trans PCMCIA CDMA
# Wireless card.
Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<39062&>5B5%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U)
T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 SP3
Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U)
T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 [Version 5.00.2195]  SP3
Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I)
T1(DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 SP3
Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I)
T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 5.00.2195 with SP 3
Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<876AE&>98E)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows 2000: v5.00.2195: SP4
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 with SP4 ( version 5.0 (build 2195: sp 4) )
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<17D54&>2B4%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS|A%Ops=MNW|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows 2000 Professional 5.00.2195 SP4 incl. latest Hotfixes till 30.12.2004
# Microsoft Windows 2000 build 2195 SP 4
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<139354&>972%IPID=I%TS=U)
T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 build 2195 SP4 with update patches through 4/22/2004
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BFDA&>357%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<C%SI=<B994C&>A06%IPID=I%TS=U)
T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<51CB6&>2DF%IPID=I)
T1(DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint Windows 2000 build 5.00.2195 SP4
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<78816&>95%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 Version 5.0 Build 2195 SP 4 X86
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Version 5.0 build 2195 SP 4
Fingerprint Microsoft Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=7FFF|832C|FA00%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF|832C|FA00%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 SP4 and latest Windows Update patches as of Sept 26, 2003 running BlackICE
# Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of September 01, 2003
Fingerprint Microsoft Windows 2000 SP4 or Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1E58A2&>1517)
T1(DF=Y%W=2238|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# base on msg 2213(-2210), 2378, 2473, 2476, 2174, 2153, 1942, 1955
# Microsoft Windows 2000 Professional (German) with SP4 build 2195 and latest Windows Update patches (2005.5.19)
# Windows 2000 terminal version 5.0 build 2195 service pack 4
# Microsoft Windows 2000 Professional SP4 and latest Windows Update patches (2005.6.11)
# Microsoft Windows 2000 Server with SP4 and latest Windows Update patches as of May 17, 2005
# Windows XP Professional Version 2002 Service Pack 1
# Microsoft Windows 2000 Advanced Server SP4
Fingerprint Microsoft Windows 2000 SP4 or XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 Standard Edition
# Microsoft Windows 2003 standard edition Version 5.2 (Build 3790.srv03_gdr.040410-1234)
# Microsoft Windows 2003 Server with SP1
# Windows Server 2003 Enterprise SP1 + hotfixes (build 3790.srv30_sp1_rtm.050324-1447 : Service Pack 1)
# Windows 2003 Enterprise SP1 Version 5.2 (Build 3790.srv03_sp1_rc1.041202-1618 : +Service Pack 1, v.1)
# Microsoft Windows XP Professional /w SP2 build 2600.xpsp_sp2_rtm.040803-2158
# Microsoft Windows 2003 Standard Edition SP1 Updated through June 19th 2005
# Windows Server 2003 Enterprise Edition (Version 5.2 Build 3790.srv03_sp1_rtm.050324-1447 : +Service Pack 1)
Fingerprint Microsoft Windows 2003 Server, 2003 Server SP1 or XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

#  Microsoft Windows 2000 with Service Pack 3
# Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of February 1st, 2003
Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP
Class Microsoft | Windows | NT/2K/XP | general purpose
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<20%SI=<E92A&>240)
T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 3.10 (Build 528)
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U)
T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
PU(Resp=N|Y)

Fingerprint Microsoft Windows NT 4.0 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73)
T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT)
T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S|S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP5
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<6%SI=<50%IPID=BI%TS=U)
T1(DF=Y%W=C000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=C000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP5-SP6
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<DA16&>21A)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows NT 4.0 Service pack 6 w/exchange 5.5
# Microsoft Windows NT 4.0 service pack 6 (English)
Fingerprint Microsoft Windows NT 4.0 SP6
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<1F9C8&>FA%IPID=BI|RPI|RD%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows NT4.0 Workstation SP6a
# Windows NT4.0 with Service Pack 6
# Microsoft Windows NT4.0 Terminal Server Edition with Service Pack 6 and Citrix MetaFrame 1.8 with Service Pack 4
Fingerprint Microsoft Windows NT 4.0 SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<A%SI=<1A66C&>112%IPID=RPI|BI%TS=U)
T1(DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP6a with Kerio WinRoute Pro 4.27 Firewall
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<8%SI=<8C%IPID=BI|RPI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T5(DF=N%W=1000|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<BEF0&>1D4%IPID=BI%TS=U)
T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a
Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U)
T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT Version 4 (Build 1381) Service Pack 6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<377BC&>3BB%IPID=RPI|BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP [Version 5.1.2600]
Fingerprint Microsoft Windows XP
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2C09C&>2CB%IPID=I%TS=U)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Windows XP Home Edition
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U)
T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Home Edition (English) SP2 build 2600.xps_p2_gdr.050301:1519
Fingerprint Microsoft Windows XP Home Edition (English) SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows XP Home Edition (German) SP1
# ver 5.1 build 2600.xpsp2.030422-1633 : SP 1; German version
# Microsoft Windows XP Home Edition (German) SP1 
Fingerprint Microsoft Windows XP Home Edition (German) SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<129062&>775%IPID=I)
T1(DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows XP Version 5.1 Home German SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : SP2), latest Updates as of Oct 27, 2004
Fingerprint Microsoft Windows XP Home Edition (German) SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Home Edition (English) SP1 Version 5.1.2600.1106 build 2600 xpsp.1.020828-1-920
Fingerprint Microsoft Windows XP Home Edition SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<163E6&>31F%IPID=I)
T1(DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Home Edition (Italian) SP1 build 2600.xpclnt_qfe.021108-2107
# Windows XP Home Edition SP2
Fingerprint Microsoft Windows XP Home Edition SP1 or SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2522E&>381%IPID=I%TS=U)
T1(DF=Y%W=1FE0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Professional WITHOUT ANY service packs
# Windows XP SP1
Fingerprint Microsoft Windows XP Pro
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U)
T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# No service packs
Fingerprint Microsoft Windows XP Pro (German)
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1074EE&>E48%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows XP Prof Corporate (German) SP1 + all Security Updates as of Febr. 10, 2004
Fingerprint Microsoft Windows XP Pro (German) SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<15BA8&>2DA%IPID=I%TS=U)
T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro (German) SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<23E9C&>195%IPID=I)
T1(DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# No service packs
Fingerprint Microsoft Windows XP Pro (Italian)
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<3CF14&>33C)
T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint Microsoft Windows XP Pro (Spanish) SP2
Fingerprint Microsoft Windows XP Pro (Spanish) SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Windows XP Pro or Windows 2000 Professional SP2+
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I)
T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro RC1+ through final release
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I)
T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microaodr Windows XP Pro with SP! and latest Windows Update patches as of June 1, 2005
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# bsed on msg 2236, 1304
# Microsoft R Windows Version 5.1 (Build 2600.xpsp2.040919-1003 : Service Pack 1)
# Microsoft Windows XP version 5.1 (no. 2600 xpsp2.040919-1003: Service Pack 1)
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2553A&>42E%IPID=I)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<31812&>7D7%IPID=I)
T1(DF=Y%W=7D00%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Professional Edition Version 5.1 Build (2600.xpsp2.030422-1633: Service Pack 1)
# Microsoft Windows XP Professional SP1 and latest patches as of Jan 31,2004
# Microsoft Windows XP Professional (Italian) SP1 build 2600.xpsp2.030422-1633# Microsoft Windows XP Pro (Spanish) SP1 (Build 2600.xpsp2.030422-1633 : Service Pack 1) Intel
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<29446&>49E%IPID=I)
T1(DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<10225A&>105E)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows XP Version 5.1 (Build 2600.xpsp2.030422-1633: Service pack 1)
# Windows XP Professional With serice pack 1... English..   2600.xpsp1.020828-1920
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U)
T1(DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS||A%Ops=M||)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Professional Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1)
# Windows XP SP1 running ZoneAlarm
# Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.040517-1325: Service Pack 1)
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U)
T1(DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2F7D8&>239%IPID=I)
T1(DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Xp Professional Service Pack 1 version 5.1 - Build  2600
# Microsoft Windows XP version 5.1 (build 2600.xpsp2.030422-1633 : Service Pack 1)
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I)
T1(DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<17D36&>18B%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP [Version 5.1.2600] (XP Professional SP1)
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Version 5.1 Build 2600.xpsp2.030825-2117: Service Pack 1
# Microsoft Windows XP Professional SP1 build 2600, latest windows updates (march 27, 2005)
Fingerprint Microsoft Windows XP Pro SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1B1AC&>29E%IPID=I%TS=U)
T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Professional 2002 - Service Pack 1 - Hotfixes
# Windows XP Profesional build 2600.xpsp2.030422-1633: Service Pack 1
# Windows XP Professional SP1 build 2600.xpsp1.030422-166: Service Pack 1
# Windows XP Professional (Italian) build 2600 with SP1 and latest Windows Update patches as of middle Sept. 2004 circa
# Microsoft Windows 2000 SP4 all updates as of Apr 17 2004
Fingerprint Microsoft Windows XP Pro SP1 or 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<209B8&>33C%IPID=I)
T1(DF=Y%W=6270|FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Professional SP1
# Microsoft Windows 2000 Advanced Server with Service Pack 3
Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 Advanced Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U)
T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Professional Build 2600.xpsp1.020828-1920 with Windows Services for UNIX 3.0 installed
# Windows 2000 Advanced Server with SP3
# Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3
# Windows 2000 SP3
Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I)
T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Professional w/ SP1 V5.1.2600 and most WU patches as of 4/20/05
# Microsoft Windows XP Professional 5.1.2600 Service Pack 1 Build 2600
# Microsoft Windows XP Home Edition (English) with Service Pack 2
# Windows XP Professional (Version 5.1 - Build 2600.xpsp2.050301-1526: Service Pack 1)
# version 5.1 build 2600 xpsp2 040919-1003 service pack 1
# Windows 2000 SP4 Version 5.0 (Build 2195: Service Pack 4) on a 2 GHz Pentium 4
# Microsoft Windows 2000 s/SP4 build 5.00.2195
# Microsoft Windows 2000 Professional 5.00.2195 SP4 - all patches as of 02 Jun 2005 (OEM)
# Windows 2000 Advanced Server SP4 and patches as of June 17 2004
# Microsoft Windows 2000 Professional (v5.0, Build 2195, SP4), all current hotfixes applied 7th June
# Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of June 21, 2005
# Microsoft Windows 2000 Advanced SP4 running Sphinx a-Wall
# Microsoft Windows XP Professional SP1a build 2600.xpsp2.050301-1526
# Microsoft Windows XP Professional (German) SP1 build 2600.xpsp1.050301-1526
Fingerprint Microsoft Windows XP Pro SP1/SP2 or 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Professionnel (5.1) Service Pack 2
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Microsoft Windows XP Professional Service Pack 2 Build 5 1 2600
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows Version 5.1 (Build 2600.xpsp_sp2_trm.040803-2158 : Service Paxk 2) (XP Professional +SP2 + Hotfix)
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows xp Professional SP2 German (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) with Agnitum Outpost Firewall Pro ver.+2.1.303.4009 (314)
# Microsoft Windows XP Professional Version 2002 SP2 build 5.1.2600 latest MS patches as of Feb 9, 2005
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=FB8B|FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint Microsoft Windows XP Professional SP2 and latest updates
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=R%Ops=WNMETL)
T7(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# bsed on msg 1079
# Fingerprint Microsoft Windows XP Proffesional (Polish) with SP2 and all patches available on January 19, 2005
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Professional SP2 ( Build 2600.xpsp_sp2_rtm.040803-2158)
# Microsoft WIndows XP Proffesional Version 2002 Service Pack 2
Fingerprint Microsoft Windows XP Pro SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Professional SP2: Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158: Service Pack 2 (firewall disabled)
Fingerprint Microsoft Windows XP Pro SP2 (firewall disabled)
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%IPID=I%TS=0)
T1(Resp=Y%DF=Y%W=FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=Y%DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Professional CORP. ED. Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows 2003 Enterprize Edition (version 5.2 (build 3790.srv03_gdr.040410-1234))
# Microsoft Windows XP Professional SP2 5.1.2600 SP2 Build 2600, Athlon x86, no firewall
# Windows 2003 Enterprise Server 5.2 build 3790, srv03_gdr.040410-1234  as of Feb 22, 2003
# Mircosoft Windows Server 2003 Enterprise SP1 build 3790.srv03_sp1_rtm.050324-1447
Fingerprint Microsoft Windows XP Pro SP2 or 2003 Server Enterprise Edition
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Pro Version 5.1 Build 2600
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I)
T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows XP Prof (Build 2600.xpsp2.030422-1633: SP1
Fingerprint Microsoft Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<F2F30&>702%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<C99A0A&>291F)
T1(DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > latest Windows Update patch too (1/31/03)
# Windows 2000 with Service Pack 3
Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1)
# Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of Oct 12, 2003 except Q817778
# Windows 2000 Professional with SP4 and latest Windows Update patches as of november 25th, 2003
Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP4
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I)
T1(DF=Y%W=402E|FC00|FD20%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows XP2 - version 5.1 (Build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2)
Fingerprint Microsoft Windows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=F0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP SP2 (English) Build 2600.xpsp2_rtm.040803-2158
# Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.050301-1519 : Service Pack 2)
# Microsoft Windows XP Professional (Spanizh) with SP2 and latest Windows Update patches as June 5,+2005
Fingerprint Microsoft Windows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# windows XP Professional SP2 and latest updates as of 3/7/05
# Microsoft Windows XP version 5.1 600.xpsp_sp2_rtm.040803-2158 : service pack 2
Fingerprint Microsoft Windows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# base on msg 570, 1033
# Windows XP SP2 (firewall off).  Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows Windows XP Corporate (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158 on Intel Pentium 4 1.2 GHz
Fingerprint Microsoft Windows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158
# Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158
# Microsoft Windows XP Professional with SP2 (Version 5.1 Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows XP Professional SP2 (Build 2600.xpsp_sp2_rtm.040803-2158)
# Microsoft Windows XP Professional SP2
# Windows XP SP2 (build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2)
Fingerprint Microsoft Windows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U|0)
T1(DF=Y%W=6360|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Version 5.1 (Build 2600.XPSP_SP2_GDR.050301-1519 : Service Pack 2)
Fingerprint Microsoft Windows XP SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Professional Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2
# Microsoft Windows XP Professional SP2 build 2600.xpsp_sp2_rtm.040803-2158
# Microsoft Windows XP Professional SP2 and latest Windows Updates patches as of Dec 15, 2004
# Windows Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows XP Professional (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows XP Professional (Spanish) SP2 build 2600.xpsp_sp2_trm.040803-2158
# Windows Server 2003 Standard edition, Microsoft windows vers.5.2 build 3790.srv03_rtm.030324-2048
# Microsoft Windows XP Professional Version 2002 Service Pack 2
# Windows 2003 Server Standard Edition germany
# Microsoft Windows Server 2003 EE Version 5.2 (Build 3790.srv03_gdr.040410-1234)
# Microsoft Windows XP Home Edition (hebrew) with SP2
Fingerprint Microsoft Windows XP SP2 or 2003 Server
Class Microsoft | Windows | NT/2K/XP | general purpose
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2003 Enterprise Server patches as of 3 May 2003  - NO SP1
# Microsoft windows Server 2003 Standard Edition (Corp. build) - Version 5.2 (Build+3790.srv03_gdr.040410-1234)
Fingerprint Microsoft Windows XP SP2 or 2003 Server
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Jornada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100
Fingerprint HP Jornada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA)
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows CE 3.0 build 126 on StrongARM
Fingerprint Microsoft Windows CE 3.0
Class Microsoft | Windows | PocketPC/CE | specialized
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=RPI|BI)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Pocket PC 2003 second edition vanilla on a Dell Axim x30 via 802.11
# HP t5300 running `Microsoft Windows CE 4.2
# ADAM-6500 controller with Windows CE .NET 4.10 build 908
Fingerprint Microsoft Windows CE or Pocket PC (PDA or other embedded device)
Class Microsoft | Windows | PocketPC/CE | specialized
TSeq(Class=RI%gcd=<A%SI=<1BF76&>12A%IPID=I)
T1(DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 Pro, Build 2195 SP4
Fingerprint Microsoft Windows 2000 Professional SP4
Class Microsoft | Windows || general purpose
TSeq(Class=RI%gcd=<6%SI=<457D6&>35E%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of August 11, 2004
Class Microsoft | Windows || general purpose
TSeq(Class=RI%gcd=<6%SI=<15E32&>1A1%IPID=I)
T1(DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows || general purpose
TSeq(Class=RI%gcd=<6%SI=<30714&>2A7%IPID=I)
T1(DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows Longhorn eval build 4051
Class Microsoft | Windows || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MikroTik RouterOS 2.7.20
Class MikroTik | RouterOS || software router
TSeq(Class=RI%gcd=<6%SI=<1B9B36E&>46A4A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Minix 32-bit/Intel 2.0.0
Class Minix | Minix || general purpose
TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF)
T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T4(Resp=N)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Minix 32-bit/Intel 2.0.3
Class Minix | Minix || general purpose
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Minix v2.0.2 32bits
Class Minix | Minix || general purpose
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Konica-Minolta Di3010 photocopier/printer/scanner
Class Minolta | embedded || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Minolta Di183 printer/copy machine ROM Version 1.52
Fingerprint Minolta Di183 printer/copier
Class Minolta | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# VxWorks (for Destiny D8405 Pass 2 (Firmware build for Pass 1)) version 5.4.2.
Fingerprint Minolta QMS Printer running VxWorks 5.4.2
Class Minolta | VxWorks || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Mirapoint messaging server M1000 (OS v 1.0.0)
Class MiraPoint | embedded || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint MiraPoint messaging server v3.1
Class MiraPoint | embedded || general purpose
TSeq(Class=RI%gcd=<6%SI=<DCCC6&>C2B%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Motorola BSR 1000R(tm) version 1.1.19.PRR
Fingerprint Motorola BSR 1000R
Class Motorola | BSD-misc || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Motorola System V/68 version R3V7 on a 68030
Class Motorola | BSD-misc || general purpose
TSeq(Class=RI%gcd=<14%SI=<52F8&>C0)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Motorola Surfboard SB5100e VxWorks Version: 5.4
# Motorola CG4500E Communication Gateway (cable modem)
# Thomson TCM390 cable modem; Software Version:  ST33.07.00; Software Model:   A801; Bootloader:  2.1.4c
# Motorola Surfboard Cable modem Software Version: SB5100-2.3.1.3-SCM00-NOSHHardware Version: 3MIB+Version: IIGUI Version: 1.0VxWorks Version: 5.4
# Motorola Cable Modem SB5100E SW_REV: SB5100E-2.3.1.3-SCM01-NOSH
# Motorola SB5100 Surfboard 5100 Cable Modem vSB5100-2.3.1.6-SCM01-NOSH
# Thomson Cable Modem TCM410
Fingerprint Motorola (SB5100/CG4500E) or Thomson (TCM390/TCM410) Cable Modem
Class Motorola | VxWorks || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Motorola SurfBoard 4401 provided by adelphia
Fingerprint Motorola SurfBoard 4401 cable modem
Class Motorola | VxWorks || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E)

# VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3
Fingerprint Motorola SurfBoard SB4100E Cable Modem
Class Motorola | VxWorks || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Motorola Surfboard SB5100 running Software version SB5100-2.3.1.6-SCM01-NOSH
Fingerprint Motorola Surfboard SB5100 cable modem
Class Motorola | VxWorks || broadband router
TSeq(Class=RI%gcd=<6%SI=<FCB886&>286BF%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=16D0%ACK=S++|O%Flags=AS|A%Ops=MNW|)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Motorola SURFboard SBG1000-0.1.3.0-SCM05-NOSH
Fingerprint Motorola SURFboard SBG1000 Broadband router
Class Motorola | VxWorks || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint MultiTech standalone firewall box, version 3
Class MultiTech | embedded || firewall
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)

Fingerprint MultiTech MultiVoIP Version 2.01A Firmware
Class MultiTech | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MultiTech CommPlete (modem server) RAScard
Class MultiTech | embedded || terminal server
TSeq(Class=TD%gcd=388|710|A98%SI=<44)
T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MultiTech CommPlete Controller (terminal server)
Class MultiTech | embedded || terminal server
TSeq(Class=TR|RI%gcd=<6%SI=>FFFF)
T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Multi-Tech Voice over IP Box. Model number (MultiVoip 2410)
Fingerprint MultiTech MultiVoip 2410
Class MultiTech | embedded || VoIP gateway
TSeq(Class=TD%gcd=<1F502%SI=<1E%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint NAT LANB/290 router Console Program V4.00
Class NAT | embedded || router
TSeq(Class=TD%gcd=<80004%SI=<14)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded)
Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91)
Class NCD | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NCR MP-RAS 3.0.x
Class NCR | BSD-misc || general purpose
TSeq(Class=64K)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NCR MP-RAS 3.01
Class NCR | BSD-misc || general purpose
TSeq(Class=i800)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System
Class NCR | BSD-misc || general purpose
TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3
Class NCR | BSD-misc || general purpose
TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38)
T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NEC UX/4800
Class NEC | UX/4800 || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Necomm NB1300 ADSL Ethernet Modem/Router
Fingerprint Necomm NB1300 DSL router
Class Necomm | embedded || broadband router
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Host information:  @WorkStation (i960 based) X-terminal
# Neoware (was HDS) NetOS V. 2.0.1
# Hewlett-Packard Entria Model C3230A Server Version B.05.30
# Cisco 11151/Arrowpoint 150 Load Balancer
Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP Entria C3230A
Class Neoware | NetOS || X terminal
Class HP | embedded || X terminal
Class Cisco | embedded || load balancer
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetApp Data ONTAP 3.1.6 or BSDi 1.1
Class NetApp | Data ONTAP || fileserver
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetApp Data ONTAP 5.1.2 - 5.3.5r2
Class NetApp | Data ONTAP || fileserver
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetApp Data ONTAP 6.1.2R3 on an F840 filer
Class NetApp | Data ONTAP || fileserver
TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# NetApp Data ONTAP Release 6.3.1: Wed Nov 20 13:03:17 PST 2002
Fingerprint NetApp Data ONTAP Release 6.3.1
Class NetApp | Data ONTAP || fileserver
TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint NetApp F360 or F760 Filer
Class NetApp | Data ONTAP || fileserver
TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# NetApp Release 6.5.2R1: Wed Sep  8 17:00:29 PDT 2004
# NetApp Filer F820 running Ontap Release 6.5.2R1
# NetApp NetCache 5.6
# Network Appliance DataOnTap v6.5.2 "NetApp Release 6.5.2: Sun Jul 25 10:56:02 PDT 2004"
# NetApp NetCache Release 5.6.2
# NetCache OS 6.0.1
Fingerprint NetApp Filer (Data OnTap 6.5.2) or NetCache (NetApp 5.6 - 6.0.1)
Class NetApp | Data ONTAP || fileserver
Class NetApp | embedded || web proxy
TSeq(Class=TR%gcd=<6%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetApp ONTAP Release 6.3.3
Class NetApp | Data ONTAP || fileserver
TSeq(Class=RI%gcd=<6%SI=<7128C&>B45%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Network Appliance Filer running Data ONTAP Release 6.4.3
Class NetApp | Data ONTAP || fileserver
TSeq(Class=RI%gcd=<6%SI=<93792&>969%IPID=RPI|RD%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# NetCache 5.1D4 on a NetApp C1100 Box
Fingerprint NetApp NetCache C1100 (NetApp 5.1D4)
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Network Appliance NetCache C1100 (NetApp 5.0)
Fingerprint NetApp NetCache C1100 with NetAppliance 5.0
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<93D5A&>95A%IPID=BI%TS=2HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint NetApp NetCache C6100 (NetApp 5.5)
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<2642EC&>3974%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint NetApp NetCache C760 os 4.x
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint NetApp NetCache running OS 5.4R2
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.0 big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>):
# * The set of options in a SYN-ACK depends on the state of the
#   `net.inet.tcp.rfc1323' flag.
# * Releases prior to 1.3 did not randomize the ISS at all.
# * Releases prior to 1.3 incorrectly added the IP header length to the IP
#   packet length when returning an ICMP unreachable.
# * Releases prior to 1.3 calculated the window size slightly wrong.
# * Releases prior to 1.3 returned a non-zero window size when sending a RST
#   in response to an ACK on a listening socket (thereby making them
#   susceptible to stealth scanning).
# * Releases prior to 1.3H/1.3.4 did not return a response to the null flag
#   test (thereby making them susceptible to stealth scanning).
# * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in
#   the encapsulated IP header when sending an ICMP reply.  On little endian
#   machines the IP ID field was byte-swapped.  The checksums were always
#   zeroed.
# * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when
#   MTU discovery was enabled.
Fingerprint NetBSD 1.0 i386
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.0 little endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.2 - 1.2.1 big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3 - 1.3.3 big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3 - 1.3.3 little endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3H-1.5  big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# NetBSD 1.3I (after 19990119)
# NetBSD 1.4 x86
# NetBSD 1.6L/Alpha
# NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386
Fingerprint NetBSD 1.3I through 1.6
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor)
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.5_ALPHA i386
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6 - 1.6.1 (Alpha)
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI|TR%gcd=<6%SI=<656F846%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot)
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6.2 (alpha)
Class NetBSD | NetBSD || general purpose
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 1262
# NetBSD 1.6.2 (GENERIC) #0: Wed Feb 11 08:05:11 UTC 2004 sparc
Fingerprint NetBSD 1.6.2 (X86)
Class NetBSD | NetBSD || general purpose
T1(DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# NetBSD 1.6.2 on X86
# Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP.
# NetBSD 2.0_BETA i386
Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch
Class NetBSD | NetBSD || general purpose
Class Avocent | embedded || specialized
TSeq(Class=RI%gcd=<6%SI=<7679164&>F13C6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6ZC (SPARC)
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<67F4F30&>941F1%IPID=RD)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6ZD
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<8%SI=<7C2EB86&>76383%IPID=RD)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# netbsd 1.6ZH GENERIC
# NetBSD 1.6ZK NetBSD 1.6ZK #1: Thu Feb 19 18:05:56 EST 2004
# NetBSD 2.0
# NetBSD alpha1 2.0_RC4
# NetBSD 2.0.1
# NetBSD 2.0.2 (GENERIC_LAPTOP) #0: Wed Mar 23 08:59:09 UTC 2005 i386
# NetBSD 2.0.2 i386
# NetBSD 2.0.2 on sparc64
Fingerprint NetBSD 1.6ZH or 2.0 - 2.0.2
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<714D5B4&>50BA4%IPID=I)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# NetBSD 2.0 (GENERIC) i386
Fingerprint NetBSD 2.0
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<71C334A&>9705A%IPID=I%TS=U)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# NetBSD 2.0 (GENERIC) IP Filter: v4.1.3 (396) Dsl Router x86
Fingerprint NetBSD 2.0
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<73607AC&>AC1A6%IPID=RD)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD/Alpha 1.5.2 on a DEC 000/300 LX
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Netburner Model 5282 Embedded Ethernet Microcontroller
Class Netburner | embedded || specialized
TSeq(Class=RI|TD%gcd=<6%SI=<45498%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Netgear DG824M Wireless (WAP) & 4-Port ADSL Router  - Version 1.4 Release 05
Fingerprint Netgear DG824M WAP
Class Netgear | embedded || broadband router
TSeq(Class=TD%gcd=<104%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# NETGEAR FVL238 Firmware Version  Version 1.5 Release 09
Fingerprint Netgear FVL238 vpn/firewall/router
Class Netgear | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2E7205A&>76E53%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Netgear FVL328 vpn/firewall/router
Class Netgear | embedded || broadband router
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Netgear WGR614 Wireless router
Class Netgear | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Netgear FM114P ProSafe Wireless Firewall with Print Server
# netgear wgr614 v4 Wireless router
# REPOTEC IP515H Cable Router / Print Server
Fingerprint Netgear Wireless router or Netgear FM114P/REPOTEC IP515H Router & Print Server
Class Netgear | embedded || broadband router
TSeq(Class=TD%gcd=<404%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Netgear PS101 print server with firmware 6026
Fingerprint Netgear PS101 Print Server
Class Netgear | embedded || print server
T1(DF=N%W=5B4%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Netgear Printer Server PS110 firmware version: 6017
Fingerprint Netgear PS110 Print Server
Class Netgear | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Netgear GS724T Gigabit Smart Switch
Class Netgear | embedded || switch
TSeq(Class=TD%gcd=<18%SI=<14%IPID=I%TS=U)
T1(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint NetJet Version 3.0 - 4.0 Printer
Class NetJet | embedded || printer
TSeq(Class=TD%gcd=<4%SI=<4)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# IPAD Model 5000 (see www.ipad-canada.com)
# eSoft IPAD, v.1.52 -- 64 line option on i86 hardware
Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52
Class NetMatrix | embedded || general purpose
TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444)
T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i)
Class Netopia | embedded || broadband router
Class Compatible Systems | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Netopia 4541 ADSL router v5.3.4
# Netopia R7100 SDSL router
Fingerprint Netopia 4541/R7100 DSL router
Class Netopia | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Netopia Cayman 3341-ENT firmware v8.3.1r0
Fingerprint Netopia Cayman 3341-ENT ADSL Router
Class Netopia | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Netopia DSL router
Class Netopia | embedded || broadband router
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Netopia R3100-I DSL Router Firmware version v4.7.2
# Netopia 7100-C with firmware v4.6.3
Fingerprint Netopia DSL Router
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Netopia R7100-C v4.11
# Netopia R5300 router; firmware v4.11
# Netopia R9171 v4.10
# Netopia R910 v8.2r1
Fingerprint Netopia DSL router
Class Netopia | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400|2260%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Netopia R5300 Router; firmware v4.6
Fingerprint Netopia R5300 Router
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<D6DC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Netopia R9100 v4.8.2
Fingerprint Netopia R9100 DSL Router
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<FDEC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Netopia Cayman 3341 DSL router
# Radware Web Server Director NP with SynApps v8.10.02
# Cayman Model 3347W Wireless DSL Ethernet Switch
# Netopia Cayman 3347W DSL Modem and NAT Router
Fingerprint Netopia Cayman 334x router/WAP or Radware Web Server Director load balancer
Class Netopia | embedded || WAP
Class Radware | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Netscreen 5GT Plus running ScreenOS 4.0.0r5.3
Class NetScreen | ScreenOS || firewall
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(Resp=N)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Netscreen 5XP firewall+vpn (OS 3.0.1r2)
Class Netscreen | ScreenOS || firewall
TSeq(Class=TD%gcd=1000%SI=<FF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Netscreen 5XP firewall+vpn (os 4.0.3r2.0)
Class Netscreen | ScreenOS || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# NetScreen NS-204 Firewall (Version: 5.2.0r1.0)
Fingerprint NetScreen NS-204 Firewall
Class NetScreen | ScreenOS || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint NetScreen-100
Class NetScreen | ScreenOS || firewall
TSeq(Class=RI%gcd=<6%SI=<276A&>50)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint NetSilicon NetARM running ThreadX 2.0
Class NetSilicon | ThreadX || specialized
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Network Systems router NS6614 (NSC 6600 series)
Class Network Systems | embedded || router
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U
Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router
Class Nexland | embedded || broadband router
TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# A NeXT Turbo, unknown version number
Fingerprint NeXT Mach
Class NeXT | Mach || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NeXTStep/OpenStep 4.2/Intel
Class NeXT | NeXTStep || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel)
Class NeXT | NeXTStep || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenStep 4.1/NeXTStep 3.3
Class NeXT | NeXTStep || general purpose
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NIB 450-E printer network interface
Class NIB | embedded || printer
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08)
Fingerprint Nokia M1122 DSL Router
Class Nokia | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Nokia Rooftop Wireless Router model R240A
Class Nokia | embedded || router
T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=40%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2)
Class Nokia | IPSO || firewall
TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.7-BUILD026 x86
Fingerprint Nokia IPSO 3.7 running CheckPoint FW-1
Class Nokia | IPSO || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.8 Build039 (IPSO 3.8-BUILD039 releng 1404 07.23.2004-193500+i386)
# Nokia IPSO 3.8.1-BUILD028 releng 1518  12.02.2004-222502 i386
Fingerprint Nokia IPSO 3.8.x
Class Nokia | IPSO || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Symbian OS 6.1 on Nokia N-Gage v 4.03
Fingerprint Symbian OS 6.1 on Nokia N-Gage v 4.03 phone
Class Nokia | Symbian || phone
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Nortel Networks BayStack 450-24T Versions: HW:RevL  FW:V1.48 SW:v4.2.0.16 ISVN:2
Fingerprint Nortel Networks BayStack switch
Class Nortel | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Nortel Networks Passport 1100 (version 2.0.7.2)
Fingerprint Nortel Networks Passport 1100 switch
Class Nortel | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0
Class Nortel | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<E1C8A&>113A%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Nortel CallPilot 100 voicemail system
# 3Com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version:  V1.12
# Cisco 1538M Micro Hub running latest firmware
# HP TopTools Remote Control Card
# Enterasys VH2402 Switch Firmware 2.05.02 
# NTT East VoIP gateway of some sort (  http://www.ntt-east.co.jp/ced/goods/voip/index.html )
Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub
Class Nortel | embedded || telecom-misc
Class NTT | embedded || telecom-misc
Class 3Com | embedded || switch
Class Cisco | embedded || hub
Class Enterasys | embedded || switch
Class HP | embedded || remote management
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

# Northern Telecom Supernode - Nortel Micronode telephone switch running OS version GSM15
Fingerprint Nortel Micronode telephone switch running OS version GSM15
Class Nortel | embedded || telecom-misc
TSeq(Class=TD%gcd=<120004%SI=<14%IPID=Z%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Nortel Passport 4400 Series - Release 4.0.3
Fingerprint Nortel Passport 4400 Series multiservice access switch
Class Nortel | embedded || telecom-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02
Class Nortel | embedded || terminal server
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 3.12 - 5.00
Class Novell | NetWare | 3.X | general purpose
Class Novell | NetWare | 4.X | general purpose
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=TD%gcd=10|20|30|40%SI=<64)
T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME)
T4(Resp=N)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 3.12 or 386 TCP/IP
Class Novell | NetWare | 3.X | general purpose
TSeq(Class=TD%gcd=<6B4A%SI=<1E)
T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5
Class Novell | NetWare | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0)
T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint NetWare 4.11 SP8a - NetWare 5 SP4
Class Novell | NetWare | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88)
T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint novell netware 4.11
Class Novell | NetWare | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Novell NetWare 4.11-5.0SP5
Class Novell | NetWare | 4.X | general purpose
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetWare 5.0 SP 3a
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetWare 5.1 SP3
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI|RD%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.0 with Border Manager
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<5%SI=>BBBBB)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Novell NetWare 5 Support Pack Revision 06 Server Version 5.00.09
Fingerprint Novell NetWare 5.00.09 SP06
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Novell NetWare 5.1 SP5 with Groupwise
Fingerprint Novell NetWare 5.1 SP5
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.1 SP5 with Groupwise
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Novell NetWare 5.1 SP8
# Novell NetWare 6.5 SP3
# Novell Open Enterprise Server, NetWare 6.5 Support Pack Revision 03
# Novell NetWare Open Enterprise Server (OES) (English, First Customer Shipping version) installed with everything on it, X86
Fingerprint Novell NetWare 5.1 SP8 or 6.5 SP3
Class Novell | NetWare | 5.X | general purpose
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=BI|RPI%TS=U)
T1(DF=N|Y%W=17FF%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.1-6.0
Class Novell | NetWare | 5.X | general purpose
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.1SP4 - 6.0
Class Novell | NetWare | 5.X | general purpose
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.1SP5 - 6.5
Class Novell | NetWare | 5.X | general purpose
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.x
Class Novell | NetWare | 5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# NetWare 6.5 SP2 (running on a Compaq Proliant ML370)
Fingerprint NetWare 6.5 SP2
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Novell Netware 6 (no service packs)
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3B034FE&>24038%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 6 SP1
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Novell NetWare 6 SP2 running BM3.7 (with no service packs)
Fingerprint Novell NetWare 6 SP2
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 6.0 SP3
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell Netware 6.0 SP4
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell Netware 6.5 SP2
Class Novell | NetWare | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# NSG 500 router. OS version 7.6.1 (http://www.nsg.ru)
# NSG-520/Network Systems Group, running Version 7.6.1
# NX-300/3wl/1e1/Network Systems Group running Version 7.6.3
Fingerprint NSG-300/500 series router running Version 7.6.x
Class NSG | embedded || router
TSeq(Class=TD%gcd=<50004%SI=<3C%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OkiData 20nx printer with OkiLAN 6100e TCP/IP Ethernet module
Fingerprint OkiData 20nx printer with OkiLAN ethernet module
Class Okidata | embedded || printer
TSeq(Class=C%IPID=I%TS=U)
T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Okidata 7200 Printer
Class Okidata | embedded || printer
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Okidata OKI C5100 Laser Printer
Class Okidata | embedded || printer
T1(DF=N%W=C00%ACK=S++%Flags=AS|AR%Ops=M||MNW)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Okidata OKI C7200 Printer
Class Okidata | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Open Network 501r or 531r (ADSL Router)
Class Open Networks | embedded || broadband router
TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 )
Class OpenBSD | OpenBSD | 2.7 | general purpose
TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.1 - 2.3/SPARC
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FF)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# This fingerprint had LAND patch installed
Fingerprint OpenBSD 2.1/x86
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.2 - 2.3
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E)

# With more info provided by Theo De Raadt
# OpenBSD 2.6
Fingerprint OpenBSD 2.6-2.8
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.6-2.8
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B)
T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.8 (x86)
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.9-beta through release (x86)
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.9-stable
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.0 (x86 or SPARC)
# OpenBSD 3.3 (hppa)
# OpenBSD 3.3 (GENERIC) i386
Fingerprint OpenBSD 3.0 or 3.3
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ)
T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.0 SPARC with pf "scrub in all"
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.0-STABLE (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.1 (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.1 (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.1 on an Alpha
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.2 (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.2 with pf scrub and no-df
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.3
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.3 x86 with pf "scrub in all"
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.3 x86 with pf "scrub in all"
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0|4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# OpenBSD 3.4 GENERIC#18 i386
Fingerprint OpenBSD 3.4
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.4 GENERIC#18 i386
Fingerprint OpenBSD 3.4 (X86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.4 x86
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# OpenBSD 3.4, custom kernel, pf firewall enabled
Fingerprint OpenBSD 3.4 x86 with pf "scrub in all"
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.4 x86 with pf "scrub in all"
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.4-BETA
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.5 (GENERIC#34 i386)
# OpenBSD 3.5 GENERIC#34 i386
# OpenBSD 3.6 GENERIC#59 i386
# OpenBSD 3.5 GENERIC#20 mac68k
# OpenBSD 3.6 GENERIC#203 sparc
# OpenBSD 3.6-stable on SPARC
# OpenBSD 3.6 GENERIC#304 sparc64
# OpenBSD 3.7 GENERIC#50 i386
Fingerprint OpenBSD 3.5 - 3.9
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.5 GENERIC#34 i386
# Fingerprint OpenBSD 3.5 (SPARC)
# OpenBSD 3.6 GENERIC#59 i386
Fingerprint OpenBSD 3.5 or 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Open BSD 3.6 on Soekris net 4801
# Openbsd 3.6 SPARC Generic#203
# OpenBSD 3.6 i386, default kernel
Fingerprint OpenBSD 3.5 or 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.6 GENERIC#1 i386
# OpenBSD 3.5 GENERIC#72 amd64
# OpenBSD 3.6 GENERIC#59 i386
Fingerprint OpenBSD 3.5 or 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y|N%W=4000%ACK=O|S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD convex.tohveli.net 3.6 GENERIC#3 i386, applied binpatches #1 to #10
Fingerprint OpenBSD 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=20|38%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.6 GENERIC.MP#173 i386
Fingerprint OpenBSD 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# OpenBSD 3.6 i386
Fingerprint OpenBSD 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.6 on a Sparc 20
Fingerprint OpenBSD 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.6-current i386 AMD-K6(tm) 3D processor ("AuthenticAMD" 586-class)
Fingerprint OpenBSD 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.6 GENERIC i386
Fingerprint OpenBSD 3.6
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.6 (i386)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD fwall.xxx.xx 3.6 GENERIC#42 i386
Fingerprint OpenBSD 3.6 x86 with pf "scrub in all"
Class OpenBSD | OpenBSD | 3.X | general purpose
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.7
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Pace digital cable TV receiver
Class Pace | embedded || media device
TSeq(Class=RI%gcd=<6%SI=<2C3AB3E&>62A0A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999
Class Packet Engines | embedded || router
TSeq(Class=64K)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Packet8 BPA410 Broadband Phone Adapter
Fingerprint Packet8 BPA410 Broadband Phone Adapter
Class Packet8 | embedded || VoIP adapter
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=578%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=578%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Packet8 DTA310 VoIP/POTS gateway
Class Packet8 | embedded || VoIP adapter
TSeq(Class=TD%gcd=<200034%SI=<1E%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=O%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# Packet8 DTA-310 (DTA version 1.0 US (8x8 001239))
# Packet 8 DTA310 broadband phone adapter
Fingerprint Packet8 DTA310 VoIP/POTS gateway
Class Packet8 | embedded || VoIP adapter
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T4(DF=Y%W=578%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=578%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05
Class Packeteer | pSOS || load balancer
TSeq(Class=64K)
T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Packeteer IP-PacketShaper 2000 V3.1
Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1
Class Packeteer | pSOS || load balancer
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint PalmOS 3.5.1 on m100 PDA
Class Palm | PalmOS | 3.X | PDA
TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=A78%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=A78%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200
Class Panasonic | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# (printer, scanner, copier, fax machine)
Fingerprint Panasonic DP-3520 multi-function printer
Class Panasonic | embedded || printer
TSeq(Class=TD%gcd=<E0%SI=<1E%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Panasonic panafax DX2000 SuperG3 fax machine
Class Panasonic | embedded || printer
TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Panasonic WJ-NT104 Network Interface Unit w/firmware version : V1.01G 010323A
Fingerprint Panasonic WJ-NT104 Network video device
Class Panasonic | embedded || webcam
TSeq(Class=RI%gcd=<6%SI=<3183A&>7C8%IPID=I%TS=U)
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Parks Altavia 671R router
Class Parks | embedded || broadband router
TSeq(Class=TD%gcd=<F404%SI=<1E%IPID=I%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# PCS Intus 3100 running TCL Version 5 with Firmware version 4.54
Fingerprint PCS Intus 3100 time management device
Class PCS | embedded || specialized
TSeq(Class=RI%gcd=<2004%SI=<1612&>21%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Pelco Network Camera
Class Pelco | embedded || webcam
TSeq(Class=RI%gcd=<6%SI=<1000018&>28F48%IPID=I%TS=U)
T1(DF=N%W=B4%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=B4%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=B4%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=B4%ACK=S%Flags=R%Ops=)
T5(DF=N%W=B4%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=B4%ACK=S%Flags=R%Ops=)
T7(DF=N%W=B4%ACK=S%Flags=R%Ops=)
PU(Resp=N)

# Perle 594e Network Controller
Fingerprint Perle 594e Network Controller
Class Perle | embedded || remote management
T1(DF=Y%W=C39%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=C39%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Perle JetStream 8500 Serial/Access Server, v 2.6.0
Class Perle | embedded || terminal server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Phillips ReplayTV 5000 DVR
Class Phillips | embedded || media device
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Pigtail Express VoIP phone (runs VxWorks)
Class Pigtail | VxWorks || VoIP phone
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Pirelli Microbusiness ADSL router
Class Pirelli | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Pitney Bowes DL550 photocopier
#  Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823
Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer
Class Pitney Bowes | embedded || printer
Class Konica | embedded || printer
Class Toshiba | embedded || printer
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# switch planet-fgsw-2620vs http://www.planet.com.tw/news/productnews/FGSW-2620VS.htm
Fingerprint Planet FGSW-2620VS switch
Class Planet | embedded || switch
TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Planet WAP 1950 Wireless Access Point
Class Planet | embedded || WAP
TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U)
T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Polycom Video Conference node
Class Polycom | embedded || webcam
TSeq(Class=C%Val=8B6A000%IPID=I%TS=U)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Polycom ViewStation
Class Polycom | embedded || webcam
TSeq(Class=C)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Polycom ViewStation 512K videoconferencing system
Class Polycom | embedded || webcam
TSeq(Class=C)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|80%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint PolyCom ViewStation video-conferencing system (firmware v7.2)
Class PolyCom | embedded || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint PowerShow NetworKam webcam
Class PowerShow | embedded || webcam
TSeq(Class=TD%gcd=<194%SI=<14%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Proteon OpenRoute 3.0 gt series router
Class Proteon | OpenRoute || router
TSeq(Class=TD%gcd=1%SI=0)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Proxim Stratum MP FW: 7_8_18;  managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18
Fingerprint Proxim Stratum MP Wireless bridge
Class Proxim | embedded || bridge
TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Proxim 8571 802.11a Access Point Software Version:  2.0-B11 : Aug 12 2002 11:08:16
Fingerprint Proxim 8571 802.11a Access Point
Class Proxim | embedded || WAP
TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1770%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1770%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint QMS Magicolor 2200 DeskLaser printer
Class QMS | embedded || printer
T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint QNX 4.24 - 4.25 realtime embedded OS
Class QNX | QNX || general purpose
TSeq(Class=64K)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint QNX 6.00 realtime embedded OS (x86)
Class QNX | QNX || general purpose
TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# QNX 6.00 2000/10/17-14:59:25edt x86pc x86
Fingerprint QNX 6.00 realtime embedded OS (x86)
Class QNX | QNX || general purpose
TSeq(Class=TD%gcd=<4AB54%SI=<82%IPID=I%TS=U)
T1(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00|1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030)
Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K
Class Quanterra | OS/9 || specialized
TSeq(Class=i800)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=C000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Quantum Snap server 4100
Class Quantum | embedded || storage-misc
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Quantum Snap Server Network Storage Box
Class Quantum | embedded || storage-misc
TSeq(Class=i800)
T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Racal 7100 Host Security Module 1.05 / 5.05
Class Racal | embedded || encryption accelerator
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Radware Content Inspection Director v2.10.03
Class Radware | embedded || security-misc
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Raptor firewall 5.03 on NT 4
Class Raptor | embedded || firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Raptor Firewall 6 on Solaris 2.6
Class Raptor | Solaris | 2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0)
T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem
Class RCA | embedded || broadband router
Class Cisco | embedded || hub
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint RCA/Thomson cable modem DCM-235/245
Class RCA | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Redback SMS 1800 router
Class Redback | AOS || router
TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Redback SMS 1800 router AOS Release 5.0.3.8
# Redback Networks SMS 10000 AOS 6.0.5.0
# Thomson TMC 390 cable modem
Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem
Class Redback | AOS || router
Class Thomson | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE
# Redback Networks AOS Release 5.0.3.8 PRODUCTION MAINTENANCE RELEASE
Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.3.8 - 5.0.4.0
Class Redback | AOS || router
TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|E|F%UCK=0|F%ULEN=134%DAT=E)

Fingerprint Redback SMS 1000-2000 DSL Router
Class Redback | embedded || broadband router
TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Ricoh Aficio AP4500 Network Laser Printer
Class Ricoh | embedded || printer
TSeq(Class=C%Val=0)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ringdale RP21 Print Server
Class Ringdale | embedded || print server
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Rio Karma mp3 player
Class Rio | embedded || media device
TSeq(Class=RI%gcd=<6%SI=<47130&>1BB%IPID=RD%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# RiverStone RS3000 System Software version 9.1.2.5
Fingerprint RiverStone RS3000 router
Class RiverStone | embedded || router
TSeq(Class=RI%gcd=<6%SI=<60158&>7CD%IPID=I%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint RoadLanner Broadband router BRL-04FW 6.15.02r Build 0091 L:01
Class RoadLanner | embedded || broadband router
TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2
Class Rockwell | embedded || telecom-misc
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Ricoh Aficio 270 copier Ver. 1.4.9, Network Interface Board Ver. 4.0.7 (ELAND__99)
Fingerprint Savin 9927 Copier or Ricoh Aficio 270 copier
Class Savin | embedded || printer
Class Ricoh | embedded || printer
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Scientific Atlanta Explorer 4200 - Digital Cable Box
Fingerprint Scientific Atlanta Explorer 4200 Digital Cable Box
Class Scientific-Atlanta | embedded || media device
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=68%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Scientific Atlanta PowerVu Program Receiver Model D9850/9010, Version: 1.51 2004-02-06 14:45:06
Fingerprint Scientific Atlanta PowerVu Program Receiver Model D9850/9010
Class Scientific-Atlanta | embedded || media device
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO OpenServer 5.0.5
Class SCO | OpenServer || general purpose
TSeq(Class=RI%gcd=<5%SI=>FFFF)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO OpenServer 5.0.7
Class SCO | OpenServer || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=832C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8058%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO OpenServer Release 5
Class SCO | OpenServer || general purpose
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO OpenServer Release 5
Class SCO | OpenServer || general purpose
TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6)
T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SCO Open Desktop ( Same as SCO UNIX?)
Fingerprint SCO Open Desktop 2.0
Class SCO | SCO UNIX || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint SCO UNIX release 3.2
Class SCO | SCO UNIX || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 2.01
Class SCO | UnixWare || general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 2.1
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# SCO UnixWare 2.1 LiveScan Fingerprint Server
Fingerprint SCO UnixWare 2.1
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=<6D77C0&>B174%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 2.1.2
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<BB%SI=>FFFF)
T1(W=60F4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=)
T4(W=0%ACK=O%Flags=R%Ops=)
T5(W=0%ACK=S++%Flags=AR%Ops=)
T6(W=0%ACK=O%Flags=R%Ops=)
T7(W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86)
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ)
T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 7.1.0 x86
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

#  UnixWare 7.1.1 i386 x86at SCO UNIX_SVR5
Fingerprint SCO UnixWare 7.1.1
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=<874330&>B9D5%IPID=I%TS=U)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Secure Computing SECUREZone Firewall Version 2.0
Class Secure Computing | embedded || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Secure Computing Sidewinder firewall 3.2 update 4
Class Secure Computing | embedded || firewall
TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Secure Computing Sidewinder firewall 5.2.1.06
Class Secure Computing | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sega Dreamcast game console
Class Sega | embedded || game console
TSeq(Class=TD%gcd=<780%SI=<14)
T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sequent DYNIX/PTX 4.4.2
Class Sequent | DYNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<15E0&>23)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Sequent DYNIX/ptx 4.4.6 x86
Class Sequent | DYNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Sequent DYNIX/ptx V4.2.1
Class Sequent | embedded || general purpose
TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Sequent DYNIX/ptx V4.4.6
Class Sequent | embedded || general purpose
TSeq(Class=RI|TD%gcd=<6%SI=<3FC)
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# SGI Iris Indigo R4000 running IRIX 4.0.5F
Fingerprint SGI IRIX 4.0.5F
Class SGI | IRIX | 4.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=EF1F%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF1F%ACK=O%Flags=A%Ops=)
T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 5.2
Class SGI | IRIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 5.3
Class SGI | IRIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.2
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1FA0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1FA0%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.2 - 6.5
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0)
T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.2 - 6.5
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=i800)
T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.4 - 6.5.3m  # Lamont Granquist (again :)
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI%gcd=10%SI=<2222)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IRIX sgi 6.5 10100655 IP32 - Silicon Graphics O2 on MIPS R12000 
Fingerprint SGI IRIX 6.5 (MIPS)
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TD%gcd=<FA4%SI=<118%IPID=I%TS=2HZ)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5 Origin2
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IP19/IP27/IP30/IP32
Fingerprint SGI IRIX 6.5-6.5.15m
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI|64K|i800%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ)
T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SGI IRIX 6.5.14, SGI O2
# SGI IRIX 6.5 IP32
Fingerprint SGI IRIX 6.5.14
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SGI IRIX 6.5.15m on SGI O2
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SGI IRIX 6.5.16m
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI|i800%gcd=<144%SI=<712%IPID=RPI%TS=2HZ)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IRIX 6.5 6.5.20m IP32
Fingerprint SGI IRIX 6.5.20m
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SGI Indigo2 R10000 running IRIX64 6.5.20m
Fingerprint SGI IRIX 6.5.20m
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5.25
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5.7f-6.5.8f
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# SGI O2 running SGI IRIX 6.5.7f
Fingerprint SGI IRIX 6.5.7f-6.5.8f
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sharp DIGITAL Imager (copier) AR-507
Class Sharp | embedded || printer
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sharp Network Printer AR-337
Class Sharp | embedded || printer
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

#  Shiva AccessPort Bridge/Router Software V 2.1.0
#  3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59
Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59
Class Shiva | embedded || router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Shiva LanRover/8E Version 3.5
Class Shiva | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Siemens 5940 T1E1 [COMBO] Router (5940-001) v6.1.020-1
Fingerprint Siemens Broadband Router 5940 T1/E1
Class Siemens | embedded || broadband router
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Siemens Santis 50 Wireless adsl router / Firmware version: 5.0.0.11 CPU: Helium 210-80
# A Wireless router which functions as a gateway to the internet.
Fingerprint Siemens Santis 50 Wireless adsl router
Class Siemens | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
T1(DF=N%W=1FFE%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1FFE%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=1FFE%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens Speedstream 2602 DSL/Cable router
Class Siemens | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Siemens HICOM 300 Phone switch (PBX) (WAML LAN card)
Fingerprint Siemens HICOM 300 Phone switch (PBX)
Class Siemens | embedded || PBX
TSeq(Class=64K)
T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=)
T4(DF=N%W=808%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Siemens HICOM Phone switch (PBX)
Class Siemens | embedded || PBX
TSeq(Class=RI%gcd=<A%SI=<4184D0&>4EB3%IPID=I%TS=100HZ)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens HiPATH3500 VoIP PBX
Class Siemens | embedded || PBX
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Siemens S7-400 PLC CPU-416-2
Fingerprint Siemens S7-400 programmable logic controller
Class Siemens | embedded || specialized
TSeq(Class=RI%gcd=<6%SI=<583DCAE&>977AD%IPID=I%TS=U)
T1(DF=N%W=230%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=230%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Siemens HiCom 300E business phone system Release 6.5
Class Siemens | embedded || VoIP phone
TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000
Class Siemens | ReliantUNIX || general purpose
TSeq(Class=64K)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Reliant UNIX 5.45B20 running on an RM400 (Siemens stuff)
Fingerprint Siemens Reliant UNIX 5.45B20
Class Siemens | ReliantUNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<A53AC&>100C%IPID=I%TS=2HZ)
T1(DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45
Class Siemens | ReliantUNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-N 5.41C0005
Class Siemens | SINIX || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-N 5.43C3002
Class Siemens | SINIX || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-Y 5.43B0045
Class Siemens | SINIX || general purpose
TSeq(Class=64K)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-Y 5.43C4001
Class Siemens | SINIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<26E76&>625)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Sipura SPA-2000 VoIP Firmware version 2.09d
# SPA-841 VoIP Phone (SIP) with firmware 0.9.5
# Sipura SPA SPA-1000 Software Version: 1.0.33 Hardware Version: 2.0.1
# Sipura SPA-2000 VoIP Adapter
# Sipura SPA-2000  Software Version: 2.0.10(d)   IP Phone Adaptor
# Sipura SPA-3000, firmware 2.0.13(GWg)
Fingerprint Sipura SPA-841/1000/2000/3000 POTS<->VoIP gateway
Class Sipura | embedded || VoIP adapter
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SMC Barricade SMC7004VR2.0EU DSL-Router Firmware R1.02-DDNS
Fingerprint SMC Barricade SMC7004VR2.0EU DSL router
Class SMC | embedded || broadband router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Panasonic KX-HCM10 network camera
# SMC EZConnect Wireless Access Point SMC2655W V.2
Fingerprint Panasonic network camera or SMC WAP
Class SMC | embedded || WAP
Class Panasonic | embedded || webcam
TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SMC Barricade7004VBR Boot Code v1.05
# SMC 7004VBR broadband router - firmware v1.2
# SMC Wireless AP 7004WFW
# SMC7004vwbr Barricade Wireless Cable/DSL Broadband Router
Fingerprint SMC Barricade DSL Router/Modem/Wireless AP
Class SMC | embedded || WAP
TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SMC Barricade Router, firmware 1.94a
Class SMC | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e)
Class SMC | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Smoothwall Linux-based firewall 2.2.23
Class Smoothwall | Linux | 2.2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<F1DA6&>474%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Softek Digi One RealPort serial device server
# Digi One SP Serial to Ethernet Converter Version 82000774_E 06/13/2003
Fingerprint Softek Digi One serial device server
Class Softek | embedded || specialized
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=8E%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SonicWall Pro 200 Firmware Version 6.4.2.0
Fingerprint SonicWall Pro 200 firewall
Class SonicWall | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N|Y%W=0|402E%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=0|402E%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
T4(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=)

# SonicWall 4060 firewall running SonicOS Enhaced 2.5
Fingerprint SonicWall 4060 firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# base on msg 2615
# PRO 3060 Standard SonicOS Standard 3.1.0.1-60s
Fingerprint SonicWall PRO 3060 firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Cisco 350 Access Point, software rev 12.02T1
# Accelerated Networks VoDSL - But what sort of device?
Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 350 Access Point
Class SonicWall | SonicOS || firewall
Class Enterasys | embedded || switch
Class Cisco | embedded || WAP
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint SonicWall SOHO-3 firewall
Class SonicWall | SonicOS || firewall
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SonicWall SOHO-3 firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# SonicWall SOHO3 (CPU: Toshiba 3927 H2 / 133 Mhz) Firmware version: 6.6.0.6 ROM version: 6.2.0.0
Fingerprint SonicWall SOHO3 firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=RI%gcd=<6%SI=<708FA&>904%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# SonicWall TZ 170 SonicOS 2.5.0.2 Enhanced
Fingerprint SonicWall TZ 170
Class SonicWall | SonicOS || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SonicWall TZ 170 Firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# SonicWall TZ170 Firewall with SonicOS
# SonicWall FZ170 Unrestricted (firewall/VPN appliances)  with SonicOS 2.6
# SonicOS 3.0.0.4-41s on SonicWall TZ 170
Fingerprint SonicWall TZ170 Firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint SonicWall/10 firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME)
T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SonicWall/10 firewall
Class SonicWall | SonicOS || firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sony AIBO ERS-7 running AIBO Mind 2
Class Sony | embedded || robotic pet
TSeq(Class=TR|TD%gcd=<186A4%SI=<64%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint PS2 Linux 1.0 on Sony PS2 game console
Class Sony | Linux || game console
TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)

# This appears to be used by game developers to test performance.
Fingerprint Sony PlayStation 2 Performance Analyser
Class Sony | Linux || specialized
TSeq(Class=RI%gcd=<6%SI=<18EC23A&>3FCBC%IPID=I%TS=100HZ)
T1(DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sony NewsOS 6.1.2
Class Sony | NewsOS || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sony Ericsson P800 mobile phone, Symbian OS v7.0
Class Sony | Symbian || phone
TSeq(Class=RI%gcd=<8%SI=<31996C&>200D%IPID=I)
T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Soyo G668 VoIP phone
Class Soyo | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=514%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# speedstream router 5871 v4.0.1
Fingerprint Speedstream 5871 DSL router
Class SpeedStream | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Spirent AX4000 Network Testing Tool
Class Spirent | embedded || specialized
TSeq(Class=RI%gcd=<6%SI=<761F6&>E8E%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint StackTools StackTos 1.0 embedded networking OS
Class StackTools | StackTos || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint StackTos 2.1
Class StackTools | StackTos || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Stratus VOS Release 14.3.1ae
Class Stratus | VOS || general purpose
T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Sun StorEdge T3 / Sun StorEdge T3B, Workgroup Storage Array
Fingerprint Sun StorEdge T3 Storage Array
Class Sun | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 5.10.1
Class Sun | Solaris | 10 | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C36BAC&>4838E%IPID=RPI%TS=U)
T1(DF=Y%W=C0B7%ACK=O|S++%Flags=A|AS%Ops=NNT|NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SunOS 5.10 Generic sun4u sparc SUNW,Sun-Fire-V250
Fingerprint SunOS 5.10 (sparc)
Class Sun | Solaris | 10 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SunOS webbox 5.10 Generic i86pc i386 i86pc
Fingerprint SunOS webbox 5.10 Generic
Class Sun | Solaris | 10 | general purpose
TSeq(Class=RI%gcd=<6%SI=<BE528&>D98%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.3 - 2.4
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc)
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.5, 2.5.1
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8)
T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise
Fingerprint Sun Solaris 2.6 (SPARC)
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=64K)
T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=TR%IPID=I%TS=100HZ)
T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 7 x86
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 8 (SPARC)
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1)
T1(DF=Y|N%W=109|212|2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T3(Resp=N)
T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL)
T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL)
PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E)

# Sun Solaris 8 // Sun Fire 80080
Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ)
T1(DF=Y%W=5B4|60DA|801B|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI%gcd=<8%SI=<7FA08&>620%IPID=I%TS=U)
T1(DF=Y%W=6050%ACK=S++%Flags=AS%Ops=NWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Sun Netra T1 - SunOS 5.8 Generic_108528-24 sun4u sparc SUNW,UltraAX-i2
# SunOS 5.8 Generic 117000-03, sun4u+sparc SUNW,UltraAX-i2
Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS|A%Ops=NNTNWM|NNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SunOS 5.8 Generic_108528-05 sun4u sparc SUNW,Ultra-5_10
# SunOS fenix 5.8 Generic_117350-22 sun4u sparc SUNW,Sun-Fire-880
Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# SunOS 5.8 Generic_108528-16 sun4u sparc SUNW,Ultra-5_10
Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI%gcd=<6%SI=<A4254&>10B4%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60
Fingerprint Sun Trusted Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI%gcd=<8%SI=<AD48A&>109A%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SunOS 5.9 Generic_117171-11 sun4u sparc SUNW,Sun-Fire-480R
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=R%Ops=WNMETL)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# SunOS 5.9 Generic_117171-02 sun4u sparc SUNW,Sun-Fire-V440 SPARC
# SunOS 5.9 Generic_117171-17 sun4u sparc SUNW,Sun-Fire-V440
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B77E4&>160F%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Solaris 9 on a V120
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
TSeq(Class=RI%gcd=<8%SI=<9501A&>68E%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Sun Solaris 9 Beta through Release on SPARC
# solaris 9 i386
# Solaris 9 4/04 version (SPARC)
# Solaris 10
Fingerprint Sun Solaris 9 or 10
Class Sun | Solaris | 9 | general purpose
Class Sun | Solaris | 10 | general purpose
TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ)
T1(DF=Y%W=5B4|C0B7|801B|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2
Class Sun | Solaris | 9 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=N|Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7)
Class Sun | SunOS || general purpose
T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Sun SunOS 4.0.3
Class Sun | SunOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Sun SunOS 4.1.1 - 4.1.4 (or derivative), or GatorBox CS LocalTalk/Ethernet bridge
# GatorBox CS LocalTalk/Ethernet bridge running GatorShare version 3.0.3 (build X4) software
Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative)
Class Sun | SunOS || general purpose
Class Gatorbox | GatorShare || bridge
TSeq(Class=64K)
T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)

Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI
Class Sun | SunOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Swissvoice IP 10S VoIP phone
Class Swissvoice | embedded || VoIP phone
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Symantec SGS 5310 Firewall
Fingerprint Symantec Gateway Security 5310 Firewall
Class Symantec | embedded || firewall
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

# Symantec Gateway Security model 5420 (Iwill mobo)
Fingerprint Symantec Gateway Security 5420 firewall
Class Symantec | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Symantec Enterprise Firewall v7.0.4 (on Solaris 8)
Class Symantec | Solaris | 8 | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)

Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2
Class Symantec | Windows | NT/2K/XP | firewall
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Symbol/Spectrum24 Wireless AP
Class Symbol | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.systech.com/catalog/RCS3000Entry.html
# RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18)
Fingerprint Systech RCS/3182 Ethernet serial port server (firmware 06D)
Class Systech | embedded || specialized
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Tahoe OS 1.2.1 running on Tahoe router
Class Tahoe | Tahoe OS || router
TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Tainet WANpro 2000i Broadband router
Class Tainet | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Talaris 1794 Printstation, firmware version 4.3.2, released 6/21/93
Fingerprint Talaris 1794 Printstation
Class Talaris | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<4010&>8F%IPID=BI%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Tally 9112 Printer
Class Tally | embedded || printer
TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Tallycom+ Print Server
Class Tally | embedded || printer
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=1C20%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Tandberg X-terminal
Class Tandberg | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Tandem NSK D39
Class Tandem | Tandem NSK || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Tandem NSK D40
Class Tandem | Tandem NSK || general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Tektronix Phaser 350 firmware 3.3 (printer)
Fingerprint Tektronix Phaser 350 printer
Class Tektronix | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Tektronix Phaser 560 printer
Class Tektronix | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<8C8C0&>B05%IPID=I%TS=U)
T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# From a Tektronix Phaser 350
#  Tektronix Phaser printer with shared Ethernet card, firmware version 3.01
Fingerprint Tektronix Phaser printer
Class Tektronix | embedded || printer
TSeq(Class=RI%gcd=<F%SI=>888&<4444)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Tektronix Phaser 860 Printer
# Tektronix Phaser 840
Fingerprint Tektronix Phaser printer
Class Tektronix | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Tektronix Phaser 360 Extended
# Tektronix Phaser 750
Fingerprint Tektronix/Xerox Phaser printer
Class Tektronix | embedded || printer
TSeq(Class=i800)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Telebit NetBlazer router version 3.0
Class Telebit | embedded || router
TSeq(Class=TD%gcd=<100004%SI=<3C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Telebit NetBlazer router Version 3.05
Class Telebit | embedded || router
TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# (Telebit router - 18 async/1 ether)
# Telebit NetBlazer router Version 3.1, patch level 13
Fingerprint Telebit NetBlazer router Version 3.1
Class Telebit | embedded || router
TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Telindus 1124  ADSL router
Fingerprint Telindus 11xx ADSL Router
Class Telindus | embedded || broadband router
TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1F40|3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=1F40|3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Telocity (DirectTVDSL) Gateway x2 Model
Class Telocity | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Telos Zephyr Xstream v2.71p ISDN/POTS/Ethernet audio transceiver
Class Telos | embedded || media device
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Signal Network Technology Co, Ltd, VoIP appliance model sp100x running firmware version SP100X3.0.1
Fingerprint CPV Telsey Broadband + voip residential gateway or Signal SP100x VoIP appliance
Class Telsey | embedded || broadband router
Class Signal | embedded || VoIP gateway
TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Teltrend (aka Securicor 3net) Router
Class Teltrend | embedded || router
TSeq(Class=TD%gcd=388|710%SI=<F)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Terayon Tj715x cable modem
Class Terayon | embedded || broadband router
TSeq(Class=TD%gcd=<1364%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Thales WebSentry HSM Crypto Accelerator
Class Thales | embedded || encryption accelerator
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

# Speed touch 500 Series ADSL Router(Linux embeded)
# Thomson SpeedTouch 510 Broadband Router, with firmware 4.2.7.16.0
# Thomson SpeedTouch 510 DSL Router: 0344EGGNP  4.2.3.0.0  LLT6AA4.230
# Thompson SpeedTouch 510 dsl router - software version  4.2.3.0.
# Firmware 4.2.3.0.0 on Thomson (ex-Alcatel) SpeedTouch 510v4/530 DSL modem.
# Thomson Speedtouch 530 ADSL modem/router, firmware 4.2.7.16.0, board ADNT-Q
Fingerprint Thomson Speed Touch 500 Series or 610i *DSL modem
Class Thomson | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Thomson THG 520 Cable Modem
Class Thomson | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Toshiba DOCSIS Cable Modem: HW_REV: 7.1; SW_REV: 1.8.017
Fingerprint Toshiba DOCSIS Cable Modem
Class Toshiba | embedded || broadband router
TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Toshiba TR650 ISDN Router
Class Toshiba | embedded || broadband router
TSeq(Class=TD%gcd=<9%SI=<14)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Toshiba estudio 4511 Multifunction Copier/Fax/Scanner/Printer
Class Toshiba | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<4831A2C&>78B67%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Treck Inc. TCP/IP stack (v2.1) on Orbacom T5 System Manager card (CPC-CAD)
Fingerprint Treck TCP/IP stack v2.1
Class Treck | Treck || general purpose
TSeq(Class=TD%gcd=<3D094%SI=<DC%IPID=I%TS=U)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# http://www.turtlebeach.com/site/products/audiotron/producthome.asp
Fingerprint Turtle Beach AudioTron 100 network MP3 player or Microsoft Windows 98SE
Class Turtle Beach | embedded || media device
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Turtle Beach AudioTron with firmware 3.0.0
Fingerprint Turtle Beach AudioTron network MP3 player
Class Turtle Beach | embedded || media device
TSeq(Class=TD%gcd=<68%SI=<14%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# AudioTron with 3.0.26 Firmware
Fingerprint Turtle Beach AudioTron network MP3 player
Class Turtle Beach | embedded || media device
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=RPI|RD%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint US Robotics Total Control NETServer Card
Class US Robotics | embedded || terminal server
TSeq(Class=C%Val=7F)
T1(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# U.S. Robotics Broadband Router (Model # 8000-02, Version V2.5)
Fingerprint US Robotics Broadband router (model #8000-02)
Class US Robotics | embedded || WAP
TSeq(Class=TD%gcd=<130%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint US Robotics USR8022 Broadband Wireless router (WAP)
Class US Robotics | embedded || WAP
TSeq(Class=TD|RI%gcd=<68%SI=<636%IPID=I%TS=U)
T1(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# UTStarcom F1000 wifi voip phone Phone OS: VxWorks (for Hornet VoWifi, ARM946ES (LE) Factory Firmware) version 5.5.1.: Kernel: WIND version 2.6. : Made on Apr  5 2005, 14:49:39.
Fingerprint UTStarcom F1000 wifi voip phone
Class UTStarcom | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint MOTOROLA VANGUARD 320 IP router running OS version 5.4
Class Vanguard | embedded || router
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Motorola Vanguard 320 multi-protocol network access device V5.5 - 5.6
Class Vanguard | embedded || router
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Vega 400 SIP Version: 10.02.07.1
Fingerprint Vega 50/400
Class VegaStream | embedded || VoIP gateway
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server
Class VersaNet | embedded || terminal server
TSeq(Class=TD%gcd=<2004%SI=<14)
T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Virtual Access LinXpeed Pro 120 router running Software 7.4.33CM
Class Virtual Access | embedded || router
TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Firebox 700 Firewall - Firebox Release: andromeda;  Driver version: 7.2.B1501;  Daemon version: 7.2.B1501;  Sys_B Version: 4.61.B742;  Sys_B Version: 4.61.B742
Fingerprint WatchGuard Firebox 700 firewall
Class WatchGuard | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

# Watchguard Firebox II version 7.00 build 2448
Fingerprint WatchGuard Firebox II version 7.00
Class WatchGuard | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Watchguard SOHO 6tc, Firewall 6.3.2 Feb 27 2004 build 1, Boot ROM 5.6
Fingerprint WatchGuard Firebox SOHO 6tc firewall
Class WatchGuard | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=N%W=1540%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Watchguard SoHo 6 TC Firewall (inside)
Fingerprint WatchGuard Firebox SOHO V.5-V.6 firewall
Class WatchGuard | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint WatchGuard Firebox X700
Class WatchGuard | embedded || firewall
TSeq(Class=RI|TR%gcd=<6%SI=<2FFF7A6%IPID=Z|I%TS=100HZ|U)
T1(DF=Y|N%W=16A0|3FE0%ACK=S++%Flags=AS|BAS%Ops=MNNTNW|ME)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=16A0|3FE0%ACK=S++%Flags=AS|ASF%Ops=MNNTNW|ME)
T4(Resp=N)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint WuT Web Thermometer
Class Wiesemann & Theis | embedded || specialized
TSeq(Class=TD%gcd=<6%SI=<14%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Wooksung TelePhoSee WVP-2100 teleconference system
Class Wooksung | embedded || telecom-misc
TSeq(Class=RI%gcd=<6%SI=<18A7BDA&>3F1C4%IPID=Z%TS=100HZ)
T1(DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint WTI Internet Power Switch 1.01
Class WTI | embedded || power-device
TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(Resp=N)

Fingerprint WTI Network Power Switch v3.02
Class WTI | embedded || power-device
TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Winterm WYSE System Version 4.2.077
Class WYSE | WYSE OS || terminal server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# WYSE OS Firmware V4.2.137
Fingerprint WYSE Winterm terminal server
Class WYSE | WYSE OS || terminal server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=7800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint XCD Xconnect Print Server, firmware version CC8S-3.58 (98.09.21)
Class XCD | embedded || print server
TSeq(Class=TD%gcd=<272A%SI=<1E)
T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Dell Laser Printer 5100cn
Class Xerox | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Xerox 8830 Plotter
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=1000%SI=1)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services
Class Xerox | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xerox Document Centre ColorSeries 50
Class Xerox | embedded || printer
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Xerox DocuPrint C55
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox Docuprint N2125 network printer
Class Xerox | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox DocuPrint N40
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=<2004%SI=<8C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint xMach free distributed OS version 0.1 current
Class xMach | xMach || general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xylan OmniSwitch 5x/9x Ethernet switch, Xylogics Annex-III Comm server R10.0, or Hitachi HI-UX/WE2
Class Xylan | embedded || switch
Class Xylogics | embedded || terminal server
Class Hitachi | HI-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xylogics Micro Annex ELS terminal server x7.1.8
Class Xylogics | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xylogics Remote Annex 4000 terminal server running LynxOS realtime OS
Class Xylogics | LynxOS || terminal server
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xyplex Network 9000 terminal server
Class Xyplex | embedded || terminal server
TSeq(Class=TD%gcd=<6%SI=<6)
T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint Xyplex Terminal Server/Xyplex hardware CSERV-20 11.00.00 ROM 410000/Xyplex software Terminal Server v6.0.4 (info frm SNMP)
Fingerprint Xyplex Terminal Server CSERV-20 software v6.0.4
Class Xyplex | embedded || terminal server
TSeq(Class=TD%gcd=<2714%SI=<258%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

Fingerprint Xyplex Terminal Server v6.0.2S5
Class Xyplex | embedded || terminal server
TSeq(Class=TD%gcd=1388%SI=<F)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

Fingerprint Xyplex 1600 terminal server running MAXserver V6.0.2 firmware
Class Xyplex | MAXserver || terminal server
TSeq(Class=C|TD%gcd=<5%SI=<5)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

Fingerprint Xyplex Maxserver 1600 Terminal Server
Class Xyplex | MAXserver || terminal server
TSeq(Class=TD%gcd=<EA64%SI=<C8%IPID=I%TS=U)
T1(DF=N%W=0|100%ACK=S++%Flags=BAR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

Fingerprint Zcomax Wireless Access Point XI-1500
Class Zcomax | embedded || WAP
TSeq(Class=TD%gcd=<D24%SI=<14%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Zebra Technologies ZTC TLP2844-Z-200dpi
Fingerprint Zebra Technologies TLP2844-Z printer
Class Zebra | embedded || printer
TSeq(Class=C%Val=14001%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint ZoomAir IG-4165 Wireless gateway (WAP)
Class ZoomAir | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Hardware: ZyXel Prestige Broadband router
Class ZyXel | ZyNOS || broadband router
T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint ZyXel 944S Prestige router
Class ZyXel | ZyNOS || broadband router
T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint ZyXel P480 ISDN router running ZyNOS v2.42(O.00)
Class ZyXel | ZyNOS || broadband router
TSeq(Class=TD%gcd=<2004%SI=<1E)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# ZyXel Prestige 642R-11 (analog ADSL router) ZyNOS F/W Version: V2.50(AJ.9)
Fingerprint ZyXel Prestige 642R-11 ASDL router running ZyNOS
Class ZyXel | ZyNOS || broadband router
TSeq(Class=TD%gcd=<F0004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ZyXel Prestige 643 router
Class ZyXel | ZyNOS || broadband router
T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# ZyXel Prestige 700 broadband router
# Netgear MR314 Cable/Wireless Router
Fingerprint ZyXel Prestige 700/Netgear MR314 Broadband router
Class ZyXel | ZyNOS || broadband router
T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ZyXel Prestige 791R
Class ZyXel | ZyNOS || broadband router
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ZyXel P128imh or P480 router (ZyNOS)
# ZyNOS F/W Version: V2.50(AJ.7) | 2/28/2002
# ZyXel Prestige 645-R11 adsl router
# Intel Express 8100 Router ISDN
Fingerprint ZyXel ZyNOS based Broadband router (ZyNOS) or Intel Express ISDN router
Class ZyXel | ZyNOS || broadband router
Class Intel | embedded || broadband router
TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000|78000|1A4000%SI=<FF%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ZyXel ZyWALL 1 running ZyNOS Version V3.60(WD.3) | 05/24/2004
Fingerprint ZyXel ZyWALL 1 firewall
Class ZyXel | ZyNOS || firewall
TSeq(Class=TD%gcd=<2004%SI=<46%IPID=I%TS=U)
T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ZyXel Zywall 10W (Firmware V3.62(WH.7))
Fingerprint ZyXel Zywall 10W firewall
Class ZyXel | ZyNOS || firewall
TSeq(Class=TD%gcd=<2004%SI=<3C%IPID=I%TS=U)
T1(DF=N%W=5780%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ZyXel ZyWALL 50 running ZyNOS V3.52(WC.2)C0 | 05/02/2003
Fingerprint ZyXel ZyWALL 50 (ZyNOS 3.52)
Class ZyXel | ZyNOS || firewall
TSeq(Class=TD%gcd=<F0004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# ZyNOS version: V3.50(DT.5) | 07/06/2004 on a ZyXel ES-3024 switch
Fingerprint ZyXel switch ES-3024 ZyNOS V3.50
Class ZyXel | ZyNOS || switch
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=5780%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ZyXel ZyAir B-4000 Wireless Lan Access Point with 4 port switch running ZyNOS
Fingerprint ZyXel ZyAir B-4000 Wireless Lan Access Point
Class ZyXel | ZyNOS || WAP
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)
   07070100243ff8000081a40000000a0000000a0000000144fe8f26000018ae000000880000000a00000000000000000000002000000005reloc/share/nmap/nmap-protocols   # This list of protocols is distributed with the  -*- mode: fundamental; -*-
# Nmap Security Scanner ( http://www.insecure.org/nmap/ )
#
# This list is based on IEEE data at
# http://www.iana.org/assignments/protocol-numbers and was last updated
# by Fyodor on January 26, 2006
hopopt            0  # IPv6 Hop-by-Hop Option
icmp              1  # Internet Control Message
igmp              2  # Internet Group Management
ggp               3  # Gateway-to-Gateway
ip                4  # IP in IP (encapsulation)
st                5  # Stream
tcp               6  # Transmission Control
cbt               7  # CBT
egp               8  # Exterior Gateway Protocol
igp               9  # any private interior gateway (
bbn-rcc-mon      10  # BBN RCC Monitoring
nvp-ii           11  # Network Voice Protocol
pup              12  # PUP
argus            13  # ARGUS
emcon            14  # EMCON
xnet             15  # Cross Net Debugger
chaos            16  # Chaos
udp              17  # User Datagram
mux              18  # Multiplexing
dcn-meas         19  # DCN Measurement Subsystems
hmp              20  # Host Monitoring
prm              21  # Packet Radio Measurement
xns-idp          22  # XEROX NS IDP
trunk-1          23  # Trunk-1
trunk-2          24  # Trunk-2
leaf-1           25  # Leaf-1
leaf-2           26  # Leaf-2
rdp              27  # Reliable Data Protocol
irtp             28  # Internet Reliable Transaction
iso-tp4          29  # ISO Transport Protocol Class 4
netblt           30  # Bulk Data Transfer Protocol
mfe-nsp          31  # MFE Network Services Protocol
merit-inp        32  # MERIT Internodal Protocol
dccp             33  # Datagram Congestion Control Protocol
3pc              34  # Third Party Connect Protocol
idpr             35  # Inter-Domain Policy Routing Protocol
xtp              36  # XTP
ddp              37  # Datagram Delivery Protocol
idpr-cmtp        38  # IDPR Control Message Transport Proto
tp++             39  # TP+
il               40  # IL Transport Protocol
ipv6             41  # Ipv6
sdrp             42  # Source Demand Routing Protocol
ipv6-route       43  # Routing Header for IPv6
ipv6-frag        44  # Fragment Header for IPv6
idrp             45  # Inter-Domain Routing Protocol
rsvp             46  # Reservation Protocol
gre              47  # General Routing Encapsulation
mhrp             48  # Mobile Host Routing Protocol
bna              49  # BNA
esp              50  # Encap Security Payload
ah               51  # Authentication Header
i-nlsp           52  # Integrated Net Layer Security  TUBA
swipe            53  # IP with Encryption
narp             54  # NBMA Address Resolution Protocol
mobile           55  # IP Mobility
tlsp             56  # Transport Layer Security Protocol using Kryptonet key management
skip             57  # SKIP
ipv6-icmp        58  # ICMP for IPv6
ipv6-nonxt       59  # No Next Header for IPv6
ipv6-opts        60  # Destination Options for IPv6
anyhost          61  # any host internal protocol
cftp             62  # CFTP
anylocalnet      63  # any local network
sat-expak        64  # SATNET and Backroom EXPAK
kryptolan        65  # Kryptolan
rvd              66  # MIT Remote Virtual Disk Protocol
ippc             67  # Internet Pluribus Packet Core
anydistribfs     68  # any distributed file system
sat-mon          69  # SATNET Monitoring
visa             70  # VISA Protocol
ipcv             71  # Internet Packet Core Utility
cpnx             72  # Computer Protocol Network Executive
cphb             73  # Computer Protocol Heart Beat
wsn              74  # Wang Span Network
pvp              75  # Packet Video Protocol
br-sat-mon       76  # Backroom SATNET Monitoring
sun-nd           77  # SUN ND PROTOCOL-Temporary
wb-mon           78  # WIDEBAND Monitoring
wb-expak         79  # WIDEBAND EXPAK
iso-ip           80  # ISO Internet Protocol
vmtp             81  # VMTP
secure-vmtp      82  # SECURE-VMTP
vines            83  # VINES
ttp              84  # TTP
nsfnet-igp       85  # NSFNET-IGP
dgp              86  # Dissimilar Gateway Protocol
tcf              87  # TCF
eigrp            88  # EIGRP
ospfigp          89  # OSPFIGP
sprite-rpc       90  # Sprite RPC Protocol
larp             91  # Locus Address Resolution Protocol
mtp              92  # Multicast Transport Protocol
ax.25            93  # AX.
ipip             94  # IP-within-IP Encapsulation Protocol
micp             95  # Mobile Internetworking Control Pro.
scc-sp           96  # Semaphore Communications Sec.
etherip          97  # Ethernet-within-IP Encapsulation
encap            98  # Encapsulation Header
anyencrypt       99  # any private encryption scheme
gmtp            100  # GMTP
ifmp            101  # Ipsilon Flow Management Protocol
pnni            102  # PNNI over IP
pim             103  # Protocol Independent Multicast
aris            104  # ARIS
scps            105  # SCPS
qnx             106  # QNX
a/n             107  # Active Networks
ipcomp          108  # IP Payload Compression Protocol
snp             109  # Sitara Networks Protocol
compaq-peer     110  # Compaq Peer Protocol
ipx-in-ip       111  # IPX in IP
vrrp            112  # Virtual Router Redundancy Protocol
pgm             113  # PGM Reliable Transport Protocol
any0hop         114  # any 0-hop protocol
l2tp            115  # Layer Two Tunneling Protocol
ddx             116  # D-II Data Exchange (
iatp            117  # Interactive Agent Transfer Protocol
stp             118  # Schedule Transfer Protocol
srp             119  # SpectraLink Radio Protocol
uti             120  # UTI
smp             121  # Simple Message Protocol
sm              122
ptp             123  # Performance Transparency Protocol
isis-ipv4       124  # ISIS over IPv4
fire            125
crtp            126  # Combat Radio Transport Protocol
crudp           127  # Combat Radio User Datagram
sscopmce        128
iplt            129
sps             130  # Secure Packet Shield
pipe            131  # Private IP Encapsulation within IP
sctp            132  # Stream Control Transmission Protocol
fc              133  # Fibre Channel
rsvp-e2e-ignore 134
mobility-hdr    135  # Mobility Header
udplite         136
mpls-in-ip      137
experimental1   253  # Use for experimentation and testing
experimental2   254  # Use for experimentation and testing
  07070100243ff9000081a40000000a0000000a0000000144fe8f2600004623000000880000000a00000000000000000000001a00000005reloc/share/nmap/nmap-rpc # Known RPC numbers Nmap uses for RPC grinding -*- mode: fundamental; -*-
# $Id: nmap-rpc 2667 2005-04-23 02:47:29Z fyodor $
# This was created by Vik Bajaj <vbajaj@sas.upenn.edu> with help
# from various members of the nmap-hackers list.  
# To join nmap-hackers send mail to nmap-hackers-subscribe@insecure.org
# Nmap is available from http://www.insecure.org/nmap/
# All the rpc services we could find as of Feb26, 2005
# Tweaked a bit by Fyodor <fyodor@insecure.org>
#
# NOTE:  Eilon Gishri <eilon@aristo.tau.ac.il> has merged the nmap-rpc
# with his massive rpc file (see comments below).
# ftp://ftp.tau.ac.il/pub/users/eilon/rpc/rpc
#
# Someday I would like to reorder this with the most popular services
# first to make scans faster
#
#
# ident "@(#)rpc        1.11    95/07/14 SMI"   /* SVr4.0 1.2   */
#
# $Date: 2005-04-22 19:47:29 -0700 (Fri, 22 Apr 2005) $
#
# $Revision: 2667 $
#
# Master RPC program number data base (/etc/rpc).
#
# Maintained by Eilon Gishri <eilon@aristo.tau.ac.il>
#
# DISCLAIMER: This is provided as a public service. Neither I nor
#             anyone else guarantees the correctness of these entries.
#
# The latest version of this file is available at:
#
#            ftp://ftp.tau.ac.il/pub/users/eilon/rpc/
#
# Program numbers are assigned in groups of 0x20000000 (decimal 536870912)
# according to the following chart: 
#
#	       0x0 - 0x1fffffff		Defined by Sun 
#	0x20000000 - 0x3fffffff		Defined by user 
#	0x40000000 - 0x5fffffff		Transient 
#	0x60000000 - 0x7fffffff		Reserved 
#	0x80000000 - 0x9fffffff		Reserved 
#	0xa0000000 - 0xbfffffff		Reserved 
#	0xc0000000 - 0xdfffffff		Reserved 
#	0xe0000000 - 0xffffffff		Reserved 
#
# To obtain SUN Remote Procedure Call (RPC) numbers send an e-mail
# request to "rpc@sun.com".
#

rpcbind		100000	portmap sunrpc rpcbind
rstatd		100001	rstat rup perfmeter rstat_svc
rusersd		100002	rusers
nfs		100003	nfsprog nfsd
ypserv		100004	ypprog
mountd		100005	mount showmount
remote_dbx	100006
ypbind		100007
walld		100008  rwall shutdown
yppasswdd       100009  yppasswd
etherstatd      100010  etherstat
rquotad         100011  rquotaprog quota rquota
sprayd          100012  spray
3270_mapper     100013
rje_mapper      100014		# Remote job entry mapping service.
selection_svc   100015  selnsvc
database_svc    100016	dbsessionmgr unify netdbms dbms
rexd            100017	rex remote_exec
alis            100018	alice office_auto
sched           100019
llockmgr        100020
nlockmgr        100021
x25.inr         100022
statmon         100023
status          100024	statd rpc.statd		# Status monitor
select_lib      100025
bootparam       100026
mazewars        100027		# Mazewars game
ypupdated       100028  ypupdate
keyserv         100029  keyserver
securelogin     100030
nfs_fwdlnit     100031		# NFS network forwarding service.
nfs_fwdtrns     100032		# NFS forwarding transmitter
sunlink_mapper	100033
net_monitor	100034
database	100035		# Lightweight database
passwd_auth	100036
tfsd		100037		# Translucent file service.
nsed		100038
nsemntd		100039
pfs_mountd	100040
showfhd		100043	showfh
mvsmount	100044		# MVSmount daemon (for mvslogin mvslogout)
ioadmd		100055	rpc.ioadmd
showattrd	100059		# DFSMS/MVS NFS server
NETlicense	100062
sunisamd	100065
debug_svc 	100066	dbsrv
cmsd		100068	rpc.cmsd dtcalendar
ypxfrd		100069	rpc.ypxfrd ypxfr
bugtraqd	100071
kerbd		100078
rpc.operd	100080	opermsg		# Sun Online-Backup
ttdbserverd     100083	rpc.ttdbserverd ttdbserverd ttdbserver tooltalk
admind		100087
autofsd		100099	autofsd
event		100101	na.event	# SunNet Manager
logger		100102	na.logger	# SunNet Manager
sync		100104	na.sync
diskinfo	100105	na.diskinfo	# SunNet Manager
iostat		100106	na.iostat
hostperf	100107	na.hostperf
activity	100109	na.activity	# SunNet Manager
db_mgr		100110
lpstat		100111	na.lpstat	# SunNet Manager
hostmem		100112	na.hostmem
sample		100113	na.sample
x25		100114	na.x25
ping		100115	na.ping
rpcnfs		100116	na.rpcnfs
hostif		100117	na.hostif
etherif		100118	na.etherif
ippath		100119	na.ippath	# SunNet Manager
iproutes	100120	na.iproutes
layers		100121	na.layers
snmp		100122	na.snmp snmp-cmc snmp-synoptics snmp-unisys snmp-utk
traffic		100123	na.traffic
DNInode		100124	na.dni	DNIneT
layers2		100131	na.layers2	# SunNet Manager
nsm_addrand	100133			# Solaris's statd NSM
ktkt_warnd	100134			# Kerberos warning daemon	
etherif2	100135	na.etherif2	# SunNet Manager
hostmem2	100136	na.hostmem2	# SunNet Manager
iostat2		100137	na.iostat2	# SunNet Manager
snmpv2		100138	na.snmpv2	# SNM Version 2.2.2
sender		100139	cc_sender	# Cooperative Consoles
amiserv		100146			# AMI Daemon
amiaux		100147			# AMI Daemon
ocfserv		100150			# OCF (Smart card) Daemon
sunvts		100153
smserverd	100155	rpc.smserverd	# support removable media devices 
kcms_server	100221			# SunKCMS Profile Server
nfs_acl		100227
#
# rpc.metad - SUNWmd - Sun Solstice DiskSuite
#
metad		100229	metad	rpc.metad # METAD - SLVM metadb Daemon
metamhd		100230	metamhd	rpc.metamhd
#
nfsauth		100231
sadmind		100232			# Solstice
ufsd		100233	ufsd
gssd		100234	gss		# GSS Daemon
cachefsd	100235	cachefs		# CacheFS Daemon
rpc.metamedd	100242			# SUNWmdm - Sun Cluster
sm_symond	100244			# Solstice SyMON process controller
rpc.pmfd	100248	pmfd		# Sun Cluster - process monitor server
snmpXdmid	100249
rpc.metacld	100281			# SUNWmdm - Sun Cluster
nisd		100300	rpc.nisd
nis_cache	100301
nis_callback	100302
nispasswd	100303	rpc.nispasswdd
fnsypd          100304			# Federated Naming Service (FNS)

# MDMN_COMMD
mdcommd         100422			# SVM Multi Node Communication Daemon 
stfsloader	100424			# Standard Type Services Framework (STSF) Font Server
rpc.pts         105004  Protoserver	# Advanced Printing Software
swu_svr		120100			# Software Usage Monitoring daemon 
nf_snmd		120126			# SunNet Manager
nf_snmd		120127
pcnfsd		150001	pcnfs
#
# Pyramid
#
PyramidLock	200000
PyramidSys5	200001		# Sys5
#
CADDS_Image     200002 		# CV CADDS images.
#
pdbDA		200005
SWG		200020	swg	# DMFE/DAWS (Defense Automated Warning System)
exportmap	200023
#
# DMFE/DAWS (Defense Automated Warning System)
#
Gqsrv		200034	gqsrv
Ppt		200035	ppt
Pmt		200036	pmt
Msgt		200037	msgt
Walerts		200038	walerts
Mgt		200039	mgt
Pft		200040	pft
Msgq		200041	msgq
Smpsrv		200042	smpsrv
Dexsrv		200043	dexsrv
Statussrv	200044	statussrv
SessionServer	200046	sessionserver
SessionDaemon	200047	sessiondaemon
Pmsgq		200048	pmsgq
Filesrv		200049	filesrv
Magfetch	200050	magfetch
Optfetch	200051	optfetch
Securitysrv	200052	securitysrv
#
bundle		200100 # Delay Tolerant Networking - DTN agent
bundle_demux	200200 # Delay Tolerant Networking - DTN agent
#
# EcoTools daemons/programs
#
ecodisc		200201
ecolic		200202
eamon		200203
ecoad		200205
#
# VERSANT
# Operator Communications Software (OCS)
#
rpc.dbserv      211637  dbserv rpc.dbserv_dir
rpc.taped       217843	taped  rpc.taped_dir
rpc.taped       217854  taped  rpc.taped_dir
#
ADTFileLock     300001		# ADT file locking service.
#
# FrameMaker
#
rpc.frameusersd	300004				# FrameMaker
fmclient	300006				# FrameMaker Client
fmeditor	300007				# FrameMaker Editor
fmserver	300009	stdfm FrameServer	# FrameMaker Server
#
amd		300019	amq
#
Steering	300021		# Steering Library
#
rpc.ldmd	300029	ldm	# Unidata LDM
#
# DMFE/DAWS (Defense Automated Warning System)
#
UpdtAuditsS	300030	
Dbpass		300091	dbpass
#
clms		300145		# CenterLine CodeCenter
#
# FrameMaker
fm_flb		300214		# FrameMaker
fm_fls		300215		# FrameMaker licnese server
#
# AcuServer provides remote file access services to ACUCOBOL-85 and
# ACUCOBOL-GT applications. 
#
acuserve	300301
#
dr_daemon	300326		# Sun Enterprise Server Alternate Pathing
#
# FA&O Command Post App
#
rmd		300375
agcd		300376
#
bssd		300433	bss
drdd		300434	drd
ap_daemon       300473		# SUNWapu - Alternate Pathing (AP)
cnxmond		300483		# cluster node monitor (Digital UNIX)
cnxagentd	300484		# cluster agent (Digital UNIX)
mcserv		300516
cluinfod	300527		# cluster information server (Digital UNIX)
dmispd		300598		# Sun Solstice Enterprise DMI Service Provider
prpasswd	300632
ks		300664		# ACPLT/KS protocol
sfs		344444		# SFS - Self-Certifying File System
mapsvc		351455
berkeleydb	351457		# Sleepycat Software: Berkeley DB
prestoctl_svc	390100	presto	# Prestoserve control daemon
#
# Computer Associates
#
caasalert	351473
caservd		395644	as6_arcserve
calqserver	395645	as6_queue LQServer
camediadsvr	395646	as6_tapesvr MediaSvr
caldbserver	395647	as6_dbserver LDbserver
caauthd		395648	as6_auth
cadiscovd	395649	as6_discovery
caloggerd	395650	as6_logger
#
# Legato NetWorker
#
rap		390101	rapla
rapserv		390102	raprd
nsrd		390103	nsr	 # NetWorker service
nsrmmd		390104	nsrmm	 # NetWorker media mupltiplexor daemon
nsrindexd	390105	nsrindex # NetWorker file index daemon
nsrmmdbd	390107	nsrmmdb  # NetWorker media management database daemon
nsrstat		390109
nsrjb		390110	nsrjbd	 # NetWorker jukebox-control service
nsrexec		390113	nsrexecd # NetWorker client execution service
lgtolmd		390115		 # Legato license daemon
nsrnotd		390400		 # NetWorker notary service
#
# Remedy AR System daemons
#
arserverd       390600  arserverd
ntserverd       390601	ntserverd	# Remedy Notifier and AR Server 5.0
ntclientd       390602  ntclientd
aresclsrv       390603  aresclsrv
arservtcd       390604  arservtcd
# Remedy Flashboards daemons
flashservd	390610	flashservd
arflashbd       390619  arflashbd
#
arfastsrv       390620  arfastsrv
arfastsrv       390621  arfastsrv
arfastsrv       390622  arfastsrv
arfastsrv       390623  arfastsrv
arfastsrv       390624  arfastsrv
arfastsrv       390625  arfastsrv
arfastsrv       390626  arfastsrv
arfastsrv       390627  arfastsrv
arfastsrv       390628  arfastsrv
arfastsrv       390629  arfastsrv
arfastsrv       390630  arfastsrv
arfastsrv       390631  arfastsrv
arfastsrv       390632  arfastsrv
arfastsrv       390633  arfastsrv
arfastsrv       390634  arfastsrv
#
arlistsrv       390635  arlistsrv
arlistsrv       390636  arlistsrv
arlistsrv       390637  arlistsrv
arlistsrv       390638  arlistsrv
arlistsrv       390639  arlistsrv
arlistsrv       390640  arlistsrv
arlistsrv       390641  arlistsrv
arlistsrv       390642  arlistsrv
arlistsrv       390643  arlistsrv
arlistsrv       390644  arlistsrv
arlistsrv       390645  arlistsrv
arlistsrv       390646  arlistsrv
arlistsrv       390647  arlistsrv
arlistsrv       390648  arlistsrv
arlistsrv       390649  arlistsrv
#
# SGI
#
sgi_snoopd	391000	snoopd snoop
sgi_toolkitbus	391001
sgi_fam		391002
sgi_notepad	391003	notepad
sgi_mountd	391004  mount showmount
sgi_smtd	391005  smtd
sgi_pcsd        391006  pcsd
sgi_nfs		391007
sgi_rfind	391008  rfind
sgi_pod		391009	pod
sgi_iphone	391010
sgi_videod	391011
sgi_testcd	391012	testcd
sgi.ha_hbeat 	391013  ha_hbeat ha_heartbeat sgi_ha_hb
sgi.ha_nc	391014  ha_nc sgi.ha_nc
sgi.ha_appmon	391015  ha_appmon
sgi_xfsmd	391016
sgi_mediad	391017	mediad
sgi.ha_orcl	391018	ha_orcl
sgi.ha_ifmx	391019	ha_ifmx
sgi.ha_sybs	391020	ha_sybs
sgi.ha_ifa	391021	ha_ifa
sgi_reserved	391022
sgi_reserved	391023
sgi_reserved	391024
sgi_reserved	391025
sgi_reserved	391026
sgi_reserved	391027
sgi_reserved	391028
sgi_espd    	391029  espd
sgi_reserved	391030
sgi_reserved	391031
sgi_reserved	391032
sgi_reserved	391033
sgi_reserved	391034
sgi_reserved	391035
sgi_reserved	391036
sgi_reserved	391037
sgi_reserved	391038
sgi_reserved	391039
sgi_reserved	391040
sgi_reserved	391041
sgi_reserved	391042
sgi_reserved	391043
sgi_reserved	391044
sgi_reserved	391045
sgi_reserved	391046
sgi_reserved	391047
sgi_reserved	391048
sgi_reserved	391049
sgi_reserved	391050
sgi_reserved	391051
sgi_reserved	391052
sgi_reserved	391053
sgi_reserved	391054
sgi_reserved	391055
sgi_reserved	391056
sgi_reserved	391057
sgi_reserved	391058
sgi_reserved	391059
sgi_reserved	391060
sgi_reserved	391061
sgi_reserved	391062
sgi_reserved	391063
#
ingsqld		391434		# SCO JDBC
#
# AEDIS
#
afsd		391200
dhc		391201
cmsd		391202
xxx2trif	391203
trif2xxx	391204
dx		391205
licd		391206
#
# Compaq TruCluster - Available Server Environment 
#
asedirector	395175  asedirector	# ASE Director Daemon
aseagent	395176  aseagent	# ASE Agent Daemon
asehsm		395177  asehsm		# Host Status Monitor Daemon
aselogger	395179  aselogger	# Logger Daemon
#
pnictl		395250
# BMC
EnsignAgent	450000		# Ensign Agent
#
drac		900101		# Dynamic Relay Authorization Control
#
AdoIfServer 	1000002		# RHIC AdoIf Server (Accelerator Device Object)
notifServer	2000004		# RHIC notifServer
#
retherif	20000000	na.retherif
genagnt		20000001	na.genagnt
#
# ACeDB database server
#
acedb           20000114  rpc.acedbd
aboutdb         20000115  rpc.acedbd
aatdb           20000116  rpc.acedbd
#
seagent		20000777	# Memco/Platinum/CA SeOS security product
dbsrvr		21000023	# TACO
#
# MIDAS - Software for Nuclear Physics data aqcuisition and analysis
#
egts		28000205	# Eurogam Tape Server       (10205/udp)
ers		28000220	# Eurogam Register Server   (10220/udp)
sas		28000230	# Spectrum Access Server    (10230/udp)
#
# The range 200100000-200199999 is reserved for NeXT services ???
#
netinfobind	200100001  nibindd	# NeXT NetInfo
renderd		200100002		# NeXT renderd
#
SLSd_daemon	536870913	# HP Distributed Single Logical Screen
uidd		536870915
#
vtsk		536870916	# SunVTS diagnostic kernel
#
userd		536870916
bondd		536870917
staticd		536870918
curved		536870919
msglogd		536870920
aliasd		536870921
ticketd		536870922
glossd		536870923
futured		536870924
priced		536870928
ladderd		536870929
optiond		536870937	# FIRM option server
#
# IBM Network Database (DB2)
# NDB Program numbers added for more useful rpcinfo output
# Values are in decimal. Corresponding hexadecimal values
# for the NDB port manager is X'20000020' and for the NDB
# servers are from X'20000021' to X'20000084'.
#
ndbportmgr	536870944
ndbserver1	536870945
ndbserver2	536870946
ndbserver3	536870947
ndbserver4	536870948
ndbserver5	536870949
ndbserver6	536870950
ndbserver7	536870951
ndbserver8	536870952
ndbserver9	536870953
ndbserver10	536870954
ndbserver11	536870955
ndbserver12	536870956
ndbserver13	536870957
ndbserver14	536870958
ndbserver15	536870959
ndbserver16	536870960
ndbserver17	536870961
ndbserver18	536870962
ndbserver19	536870963
ndbserver20	536870964
ndbserver21	536870965
ndbserver22	536870966
ndbserver23	536870967
ndbserver24	536870968
ndbserver25	536870969
ndbserver26	536870970
ndbserver27	536870971
ndbserver28	536870972
ndbserver29	536870973
ndbserver30	536870974
ndbserver31	536870975
ndbserver32	536870976
ndbserver33	536870977
ndbserver34	536870978
ndbserver35	536870979
ndbserver36	536870980
ndbserver37	536870981
ndbserver38	536870982
ndbserver39	536870983
ndbserver40	536870984
ndbserver41	536870985
ndbserver42	536870986
ndbserver43	536870987
ndbserver44	536870988
ndbserver45	536870989
ndbserver46	536870990
ndbserver47	536870991
ndbserver48	536870992
ndbserver49	536870993
ndbserver50	536870994